This document is a reference manual for the LLVM assembly language. LLVM
is a Static Single Assignment (SSA) based representation that provides
type safety, low-level operations, flexibility, and the capability of
representing ‘all’ high-level languages cleanly. It is the common code
representation used throughout all phases of the LLVM compilation
strategy.

The LLVM code representation is designed to be used in three different
forms: as an in-memory compiler IR, as an on-disk bitcode representation
(suitable for fast loading by a Just-In-Time compiler), and as a human
readable assembly language representation. This allows LLVM to provide a
powerful intermediate representation for efficient compiler
transformations and analysis, while providing a natural means to debug
and visualize the transformations. The three different forms of LLVM are
all equivalent. This document describes the human readable
representation and notation.

The LLVM representation aims to be light-weight and low-level while
being expressive, typed, and extensible at the same time. It aims to be
a “universal IR” of sorts, by being at a low enough level that
high-level ideas may be cleanly mapped to it (similar to how
microprocessors are “universal IR’s”, allowing many source languages to
be mapped to them). By providing type information, LLVM can be used as
the target of optimizations: for example, through pointer analysis, it
can be proven that a C automatic variable is never accessed outside of
the current function, allowing it to be promoted to a simple SSA value
instead of a memory location.

It is important to note that this document describes ‘well formed’ LLVM
assembly language. There is a difference between what the parser accepts
and what is considered ‘well formed’. For example, the following
instruction is syntactically okay, but not well formed:

%x=addi321,%x

because the definition of %x does not dominate all of its uses. The
LLVM infrastructure provides a verification pass that may be used to
verify that an LLVM module is well formed. This pass is automatically
run by the parser after parsing input assembly and by the optimizer
before it outputs bitcode. The violations pointed out by the verifier
pass indicate bugs in transformation passes or input to the parser.

LLVM identifiers come in two basic types: global and local. Global
identifiers (functions, global variables) begin with the '@'
character. Local identifiers (register names, types) begin with the
'%' character. Additionally, there are three different formats for
identifiers, for different purposes:

Named values are represented as a string of characters with their
prefix. For example, %foo, @DivisionByZero,
%a.really.long.identifier. The actual regular expression used is
‘[%@][-a-zA-Z$._][-a-zA-Z$._0-9]*‘. Identifiers that require other
characters in their names can be surrounded with quotes. Special
characters may be escaped using "\xx" where xx is the ASCII
code for the character in hexadecimal. In this way, any character can
be used in a name value, even quotes themselves. The "\01" prefix
can be used on global variables to suppress mangling.

Unnamed values are represented as an unsigned numeric value with
their prefix. For example, %12, @2, %44.

LLVM requires that values start with a prefix for two reasons: Compilers
don’t need to worry about name clashes with reserved words, and the set
of reserved words may be expanded in the future without penalty.
Additionally, unnamed identifiers allow a compiler to quickly come up
with a temporary variable without having to avoid symbol table
conflicts.

Reserved words in LLVM are very similar to reserved words in other
languages. There are keywords for different opcodes (‘add‘,
‘bitcast‘, ‘ret‘, etc...), for primitive type names (‘void‘,
‘i32‘, etc...), and others. These reserved words cannot conflict
with variable names, because none of them start with a prefix character
('%' or '@').

Here is an example of LLVM code to multiply the integer variable
‘%X‘ by 8:

This last way of multiplying %X by 8 illustrates several important
lexical features of LLVM:

Comments are delimited with a ‘;‘ and go until the end of line.

Unnamed temporaries are created when the result of a computation is
not assigned to a named value.

Unnamed temporaries are numbered sequentially (using a per-function
incrementing counter, starting with 0). Note that basic blocks and unnamed
function parameters are included in this numbering. For example, if the
entry basic block is not given a label name and all function parameters are
named, then it will get number 0.

It also shows a convention that we follow in this document. When
demonstrating instructions, we will follow an instruction with a comment
that defines the type and name of value produced.

LLVM programs are composed of Module‘s, each of which is a
translation unit of the input programs. Each module consists of
functions, global variables, and symbol table entries. Modules may be
combined together with the LLVM linker, which merges function (and
global variable) definitions, resolves forward declarations, and merges
symbol table entries. Here is an example of the “hello world” module:

In general, a module is made up of a list of global values (where both
functions and global variables are global values). Global values are
represented by a pointer to a memory location (in this case, a pointer
to an array of char, and a pointer to a function), and have one of the
following linkage types.

All Global Variables and Functions have one of the following types of
linkage:

private

Global values with “private” linkage are only directly
accessible by objects in the current module. In particular, linking
code into a module with an private global value may cause the
private to be renamed as necessary to avoid collisions. Because the
symbol is private to the module, all references can be updated. This
doesn’t show up in any symbol table in the object file.

internal

Similar to private, but the value shows as a local symbol
(STB_LOCAL in the case of ELF) in the object file. This
corresponds to the notion of the ‘static‘ keyword in C.

available_externally

Globals with “available_externally” linkage are never emitted
into the object file corresponding to the LLVM module. They exist to
allow inlining and other optimizations to take place given knowledge
of the definition of the global, which is known to be somewhere
outside the module. Globals with available_externally linkage
are allowed to be discarded at will, and are otherwise the same as
linkonce_odr. This linkage type is only allowed on definitions,
not declarations.

linkonce

Globals with “linkonce” linkage are merged with other globals of
the same name when linkage occurs. This can be used to implement
some forms of inline functions, templates, or other code which must
be generated in each translation unit that uses it, but where the
body may be overridden with a more definitive definition later.
Unreferenced linkonce globals are allowed to be discarded. Note
that linkonce linkage does not actually allow the optimizer to
inline the body of this function into callers because it doesn’t
know if this definition of the function is the definitive definition
within the program or whether it will be overridden by a stronger
definition. To enable inlining and other optimizations, use
“linkonce_odr” linkage.

weak

“weak” linkage has the same merging semantics as linkonce
linkage, except that unreferenced globals with weak linkage may
not be discarded. This is used for globals that are declared “weak”
in C source code.

common

“common” linkage is most similar to “weak” linkage, but they
are used for tentative definitions in C, such as “intX;” at
global scope. Symbols with “common” linkage are merged in the
same way as weaksymbols, and they may not be deleted if
unreferenced. common symbols may not have an explicit section,
must have a zero initializer, and may not be marked
‘constant‘. Functions and aliases may not have
common linkage.

appending

“appending” linkage may only be applied to global variables of
pointer to array type. When two global variables with appending
linkage are linked together, the two global arrays are appended
together. This is the LLVM, typesafe, equivalent of having the
system linker append together “sections” with identical names when
.o files are linked.

extern_weak

The semantics of this linkage follow the ELF object file model: the
symbol is weak until linked, if not linked, the symbol becomes null
instead of being an undefined reference.

linkonce_odr, weak_odr

Some languages allow differing globals to be merged, such as two
functions with different semantics. Other languages, such as
C++, ensure that only equivalent globals are ever merged (the
“one definition rule” — “ODR”). Such languages can use the
linkonce_odr and weak_odr linkage types to indicate that the
global will only be merged with equivalent globals. These linkage
types are otherwise the same as their non-odr versions.

external

If none of the above identifiers are used, the global is externally
visible, meaning that it participates in linkage and can be used to
resolve external symbol references.

It is illegal for a function declaration to have any linkage type
other than external or extern_weak.

LLVM functions, calls and
invokes can all have an optional calling convention
specified for the call. The calling convention of any pair of dynamic
caller/callee must match, or the behavior of the program is undefined.
The following calling conventions are supported by LLVM, and more may be
added in the future:

“ccc” - The C calling convention

This calling convention (the default if no other calling convention
is specified) matches the target C calling conventions. This calling
convention supports varargs function calls and tolerates some
mismatch in the declared prototype and implemented declaration of
the function (as does normal C).

“fastcc” - The fast calling convention

This calling convention attempts to make calls as fast as possible
(e.g. by passing things in registers). This calling convention
allows the target to use whatever tricks it wants to produce fast
code for the target, without having to conform to an externally
specified ABI (Application Binary Interface). Tail calls can only
be optimized when this, the GHC or the HiPE convention is
used. This calling convention does not
support varargs and requires the prototype of all callees to exactly
match the prototype of the function definition.

“coldcc” - The cold calling convention

This calling convention attempts to make code in the caller as
efficient as possible under the assumption that the call is not
commonly executed. As such, these calls often preserve all registers
so that the call does not break any live ranges in the caller side.
This calling convention does not support varargs and requires the
prototype of all callees to exactly match the prototype of the
function definition. Furthermore the inliner doesn’t consider such function
calls for inlining.

“cc10” - GHC convention

This calling convention has been implemented specifically for use by
the Glasgow Haskell Compiler (GHC).
It passes everything in registers, going to extremes to achieve this
by disabling callee save registers. This calling convention should
not be used lightly but only for specific situations such as an
alternative to the register pinning performance technique often
used when implementing functional programming languages. At the
moment only X86 supports this convention and it has the following
limitations:

On X86-32 only supports up to 4 bit type parameters. No
floating point types are supported.

On X86-64 only supports up to 10 bit type parameters and 6
floating point parameters.

This calling convention has been implemented specifically for use by
the High-Performance Erlang
(HiPE) compiler, the
native code compiler of the Ericsson’s Open Source Erlang/OTP
system. It uses more
registers for argument passing than the ordinary C calling
convention and defines no callee-saved registers. The calling
convention properly supports tail call
optimization but requires that both the
caller and the callee use it. It uses a register pinning
mechanism, similar to GHC’s convention, for keeping frequently
accessed runtime components pinned to specific hardware registers.
At the moment only X86 supports this convention (both 32 and 64
bit).

“webkit_jscc” - WebKit’s JavaScript calling convention

This calling convention has been implemented for WebKit FTL JIT. It passes arguments on the
stack right to left (as cdecl does), and returns a value in the
platform’s customary return register.

“anyregcc” - Dynamic calling convention for code patching

This is a special convention that supports patching an arbitrary code
sequence in place of a call site. This convention forces the call
arguments into registers but allows them to be dynamically
allocated. This can currently only be used with calls to
llvm.experimental.patchpoint because only this intrinsic records
the location of its arguments in a side table. See Stack maps and patch points in LLVM.

“preserve_mostcc” - The PreserveMost calling convention

This calling convention attempts to make the code in the caller as
unintrusive as possible. This convention behaves identically to the C
calling convention on how arguments and return values are passed, but it
uses a different set of caller/callee-saved registers. This alleviates the
burden of saving and recovering a large register set before and after the
call in the caller. If the arguments are passed in callee-saved registers,
then they will be preserved by the callee across the call. This doesn’t
apply for values returned in callee-saved registers.

On X86-64 the callee preserves all general purpose registers, except for
R11. R11 can be used as a scratch register. Floating-point registers
(XMMs/YMMs) are not preserved and need to be saved by the caller.

The idea behind this convention is to support calls to runtime functions
that have a hot path and a cold path. The hot path is usually a small piece
of code that doesn’t use many registers. The cold path might need to call out to
another function and therefore only needs to preserve the caller-saved
registers, which haven’t already been saved by the caller. The
PreserveMost calling convention is very similar to the cold calling
convention in terms of caller/callee-saved registers, but they are used for
different types of function calls. coldcc is for function calls that are
rarely executed, whereas preserve_mostcc function calls are intended to be
on the hot path and definitely executed a lot. Furthermore preserve_mostcc
doesn’t prevent the inliner from inlining the function call.

This calling convention will be used by a future version of the ObjectiveC
runtime and should therefore still be considered experimental at this time.
Although this convention was created to optimize certain runtime calls to
the ObjectiveC runtime, it is not limited to this runtime and might be used
by other runtimes in the future too. The current implementation only
supports X86-64, but the intention is to support more architectures in the
future.

“preserve_allcc” - The PreserveAll calling convention

This calling convention attempts to make the code in the caller even less
intrusive than the PreserveMost calling convention. This calling
convention also behaves identical to the C calling convention on how
arguments and return values are passed, but it uses a different set of
caller/callee-saved registers. This removes the burden of saving and
recovering a large register set before and after the call in the caller. If
the arguments are passed in callee-saved registers, then they will be
preserved by the callee across the call. This doesn’t apply for values
returned in callee-saved registers.

On X86-64 the callee preserves all general purpose registers, except for
R11. R11 can be used as a scratch register. Furthermore it also preserves
all floating-point registers (XMMs/YMMs).

The idea behind this convention is to support calls to runtime functions
that don’t need to call out to any other functions.

This calling convention, like the PreserveMost calling convention, will be
used by a future version of the ObjectiveC runtime and should be considered
experimental at this time.

“cc<n>” - Numbered convention

Any calling convention may be specified by number, allowing
target-specific calling conventions to be used. Target specific
calling conventions start at 64.

More calling conventions can be added/defined on an as-needed basis, to
support Pascal conventions or any other well-known target-independent
convention.

All Global Variables and Functions have one of the following visibility
styles:

“default” - Default style

On targets that use the ELF object file format, default visibility
means that the declaration is visible to other modules and, in
shared libraries, means that the declared entity may be overridden.
On Darwin, default visibility means that the declaration is visible
to other modules. Default visibility corresponds to “external
linkage” in the language.

“hidden” - Hidden style

Two declarations of an object with hidden visibility refer to the
same object if they are in the same shared object. Usually, hidden
visibility indicates that the symbol will not be placed into the
dynamic symbol table, so no other module (executable or shared
library) can reference it directly.

“protected” - Protected style

On ELF, protected visibility indicates that the symbol will be
placed in the dynamic symbol table, but that references within the
defining module will bind to the local symbol. That is, the symbol
cannot be overridden by another module.

A symbol with internal or private linkage must have default
visibility.

All Global Variables, Functions and Aliases can have one of the following
DLL storage class:

dllimport

“dllimport” causes the compiler to reference a function or variable via
a global pointer to a pointer that is set up by the DLL exporting the
symbol. On Microsoft Windows targets, the pointer name is formed by
combining __imp_ and the function or variable name.

dllexport

“dllexport” causes the compiler to provide a global pointer to a pointer
in a DLL, so that it can be referenced with the dllimport attribute. On
Microsoft Windows targets, the pointer name is formed by combining
__imp_ and the function or variable name. Since this storage class
exists for defining a dll interface, the compiler, assembler and linker know
it is externally referenced and must refrain from deleting the symbol.

A variable may be defined as thread_local, which means that it will
not be shared by threads (each thread will have a separated copy of the
variable). Not all targets support thread-local variables. Optionally, a
TLS model may be specified:

localdynamic

For variables that are only used within the current shared library.

initialexec

For variables in modules that will not be loaded dynamically.

localexec

For variables defined in the executable and only used within it.

If no explicit model is given, the “general dynamic” model is used.

The models correspond to the ELF TLS models; see ELF Handling For
Thread-Local Storage for
more information on under which circumstances the different models may
be used. The target may choose a different TLS model if the specified
model is not supported, or if a better choice of model can be made.

A model can also be specified in a alias, but then it only governs how
the alias is accessed. It will not have any effect in the aliasee.

LLVM IR allows you to specify both “identified” and “literal” structure
types. Literal types are uniqued structurally, but identified types
are never uniqued. An opaque structural type can also be used
to forward declare a type that is not yet available.

An example of a identified structure specification is:

%mytype=type{%mytype*,i32}

Prior to the LLVM 3.0 release, identified types were structurally uniqued. Only
literal types are uniqued in recent versions of LLVM.

Global variables define regions of memory allocated at compilation time
instead of run-time.

Global variable definitions must be initialized.

Global variables in other translation units can also be declared, in which
case they don’t have an initializer.

Either global variable definitions or declarations may have an explicit section
to be placed in and may have an optional explicit alignment specified.

A variable may be defined as a global constant, which indicates that
the contents of the variable will never be modified (enabling better
optimization, allowing the global data to be placed in the read-only
section of an executable, etc). Note that variables that need runtime
initialization cannot be marked constant as there is a store to the
variable.

LLVM explicitly allows declarations of global variables to be marked
constant, even if the final definition of the global is not. This
capability can be used to enable slightly better optimization of the
program, but requires the language definition to guarantee that
optimizations based on the ‘constantness’ are valid for the translation
units that do not include the definition.

As SSA values, global variables define pointer values that are in scope
(i.e. they dominate) all basic blocks in the program. Global variables
always define a pointer to their “content” type because they describe a
region of memory, and all memory objects in LLVM are accessed through
pointers.

Global variables can be marked with unnamed_addr which indicates
that the address is not significant, only the content. Constants marked
like this can be merged with other constants if they have the same
initializer. Note that a constant with significant address can be
merged with a unnamed_addr constant, the result being a constant
whose address is significant.

A global variable may be declared to reside in a target-specific
numbered address space. For targets that support them, address spaces
may affect how optimizations are performed and/or what target
instructions are used to access the variable. The default address space
is zero. The address space qualifier must precede any other attributes.

LLVM allows an explicit section to be specified for globals. If the
target supports it, it will emit globals to the section specified.
Additionally, the global can placed in a comdat if the target has the necessary
support.

By default, global initializers are optimized by assuming that global
variables defined within the module are not modified from their
initial values before the start of the global initializer. This is
true even for variables potentially accessible from outside the
module, including those with external linkage or appearing in
@llvm.used or dllexported variables. This assumption may be suppressed
by marking the variable with externally_initialized.

An explicit alignment may be specified for a global, which must be a
power of 2. If not present, or if the alignment is set to zero, the
alignment of the global is set by the target to whatever it feels
convenient. If an explicit alignment is specified, the global is forced
to have exactly that alignment. Targets and optimizers are not allowed
to over-align the global if the global has an assigned section. In this
case, the extra alignment could be observable: for example, code could
assume that the globals are densely packed in their section and try to
iterate over them as an array, alignment padding would break this
iteration. The maximum alignment is 1<<29.

A function definition contains a list of basic blocks, forming the CFG (Control
Flow Graph) for the function. Each basic block may optionally start with a label
(giving the basic block a symbol table entry), contains a list of instructions,
and ends with a terminator instruction (such as a branch or
function return). If an explicit label is not provided, a block is assigned an
implicit numbered label, using the next value from the same counter as used for
unnamed temporaries (see above). For example, if a function
entry block does not have an explicit label, it will be assigned label “%0”,
then the first unnamed temporary in that block will be “%1”, etc.

The first basic block in a function is special in two ways: it is
immediately executed on entrance to the function, and it is not allowed
to have predecessor basic blocks (i.e. there can not be any branches to
the entry block of a function). Because the block can have no
predecessors, it also cannot have any PHI nodes.

LLVM allows an explicit section to be specified for functions. If the
target supports it, it will emit functions to the section specified.
Additionally, the function can be placed in a COMDAT.

An explicit alignment may be specified for a function. If not present,
or if the alignment is set to zero, the alignment of the function is set
by the target to whatever it feels convenient. If an explicit alignment
is specified, the function is forced to have at least that much
alignment. All alignments must be a power of 2.

If the unnamed_addr attribute is given, the address is known to not
be significant and two identical functions can be merged.

Comdats have a name which represents the COMDAT key. All global objects that
specify this key will only end up in the final object file if the linker chooses
that key over some other key. Aliases are placed in the same COMDAT that their
aliasee computes to, if any.

Comdats have a selection kind to provide input on how the linker should
choose between keys in two different object files.

Syntax:

$<Name> = comdat SelectionKind

The selection kind must be one of the following:

any

The linker may choose any COMDAT key, the choice is arbitrary.

exactmatch

The linker may choose any COMDAT key but the sections must contain the
same data.

largest

The linker will choose the section containing the largest COMDAT key.

noduplicates

The linker requires that only section with this COMDAT key exist.

samesize

The linker may choose any COMDAT key but the sections must contain the
same amount of data.

Note that the Mach-O platform doesn’t support COMDATs and ELF only supports
any as a selection kind.

Here is an example of a COMDAT group where a function will only be selected if
the COMDAT key’s section is the largest:

As a syntactic sugar the $name can be omitted if the name is the same as
the global name:

$foo = comdat any
@foo = global i32 2, comdat

In a COFF object file, this will create a COMDAT section with selection kind
IMAGE_COMDAT_SELECT_LARGEST containing the contents of the @foo symbol
and another COMDAT section with selection kind
IMAGE_COMDAT_SELECT_ASSOCIATIVE which is associated with the first COMDAT
section and contains the contents of the @bar symbol.

There are some restrictions on the properties of the global object.
It, or an alias to it, must have the same name as the COMDAT group when
targeting COFF.
The contents and size of this object may be used during link-time to determine
which COMDAT groups get selected depending on the selection kind.
Because the name of the object must match the name of the COMDAT group, the
linkage of the global object must not be local; local symbols can get renamed
if a collision occurs in the symbol table.

The combined use of COMDATS and section attributes may yield surprising results.
For example:

From the object file perspective, this requires the creation of two sections
with the same name. This is necessary because both globals belong to different
COMDAT groups and COMDATs, at the object file level, are represented by
sections.

Note that certain IR constructs like global variables and functions may
create COMDATs in the object file in addition to any which are specified using
COMDAT IR. This arises when the code generator is configured to emit globals
in individual sections (e.g. when -data-sections or -function-sections
is supplied to llc).

Named metadata is a collection of metadata. Metadata
nodes (but not metadata strings) are the only valid
operands for a named metadata.

Named metadata are represented as a string of characters with the
metadata prefix. The rules for metadata names are the same as for
identifiers, but quoted names are not allowed. "\xx" type escapes
are still valid, which allows any character to be part of a name.

The return type and each parameter of a function type may have a set of
parameter attributes associated with them. Parameter attributes are
used to communicate additional information about the result or
parameters of a function. Parameter attributes are considered to be part
of the function, not of the function type, so functions with different
parameter attributes can have the same function type.

Parameter attributes are simple keywords that follow the type specified.
If multiple parameter attributes are needed, they are space separated.
For example:

Note that any attributes for the function result (nounwind,
readonly) come immediately after the argument list.

Currently, only the following parameter attributes are defined:

zeroext

This indicates to the code generator that the parameter or return
value should be zero-extended to the extent required by the target’s
ABI (which is usually 32-bits, but is 8-bits for a i1 on x86-64) by
the caller (for a parameter) or the callee (for a return value).

signext

This indicates to the code generator that the parameter or return
value should be sign-extended to the extent required by the target’s
ABI (which is usually 32-bits) by the caller (for a parameter) or
the callee (for a return value).

inreg

This indicates that this parameter or return value should be treated
in a special target-dependent fashion during while emitting code for
a function call or return (usually, by putting it in a register as
opposed to memory, though some targets use it to distinguish between
two different kinds of registers). Use of this attribute is
target-specific.

byval

This indicates that the pointer parameter should really be passed by
value to the function. The attribute implies that a hidden copy of
the pointee is made between the caller and the callee, so the callee
is unable to modify the value in the caller. This attribute is only
valid on LLVM pointer arguments. It is generally used to pass
structs and arrays by value, but is also valid on pointers to
scalars. The copy is considered to belong to the caller not the
callee (for example, readonly functions should not write to
byval parameters). This is not a valid attribute for return
values.

The byval attribute also supports specifying an alignment with the
align attribute. It indicates the alignment of the stack slot to
form and the known alignment of the pointer specified to the call
site. If the alignment is not specified, then the code generator
makes a target-specific assumption.

inalloca

The inalloca argument attribute allows the caller to take the
address of outgoing stack arguments. An inalloca argument must
be a pointer to stack memory produced by an alloca instruction.
The alloca, or argument allocation, must also be tagged with the
inalloca keyword. Only the last argument may have the inalloca
attribute, and that argument is guaranteed to be passed in memory.

An argument allocation may be used by a call at most once because
the call may deallocate it. The inalloca attribute cannot be
used in conjunction with other attributes that affect argument
storage, like inreg, nest, sret, or byval. The
inalloca attribute also disables LLVM’s implicit lowering of
large aggregate return values, which means that frontend authors
must lower them with sret pointers.

When the call site is reached, the argument allocation must have
been the most recent stack allocation that is still live, or the
results are undefined. It is possible to allocate additional stack
space after an argument allocation and before its call site, but it
must be cleared off with llvm.stackrestore.

This indicates that the pointer parameter specifies the address of a
structure that is the return value of the function in the source
program. This pointer must be guaranteed by the caller to be valid:
loads and stores to the structure may be assumed by the callee
not to trap and to be properly aligned. This may only be applied to
the first parameter. This is not a valid attribute for return
values.

align<n>

This indicates that the pointer value may be assumed by the optimizer to
have the specified alignment.

Note that this attribute has additional semantics when combined with the
byval attribute.

noalias

This indicates that objects accessed via pointer values
based on the argument or return value are not also
accessed, during the execution of the function, via pointer values not
based on the argument or return value. The attribute on a return value
also has additional semantics described below. The caller shares the
responsibility with the callee for ensuring that these requirements are met.
For further details, please see the discussion of the NoAlias response in
alias analysis.

Note that this definition of noalias is intentionally similar
to the definition of restrict in C99 for function arguments.

For function return values, C99’s restrict is not meaningful,
while LLVM’s noalias is. Furthermore, the semantics of the noalias
attribute on return values are stronger than the semantics of the attribute
when used on function arguments. On function return values, the noalias
attribute indicates that the function acts like a system memory allocation
function, returning a pointer to allocated storage disjoint from the
storage for any other object accessible to the caller.

nocapture

This indicates that the callee does not make any copies of the
pointer that outlive the callee itself. This is not a valid
attribute for return values.

nest

This indicates that the pointer parameter can be excised using the
trampoline intrinsics. This is not a valid
attribute for return values and can only be applied to one parameter.

returned

This indicates that the function always returns the argument as its return
value. This is an optimization hint to the code generator when generating
the caller, allowing tail call optimization and omission of register saves
and restores in some cases; it is not checked or enforced when generating
the callee. The parameter and the function return type must be valid
operands for the bitcast instruction. This is not a
valid attribute for return values and can only be applied to one parameter.

nonnull

This indicates that the parameter or return pointer is not null. This
attribute may only be applied to pointer typed parameters. This is not
checked or enforced by LLVM, the caller must ensure that the pointer
passed in is non-null, or the callee must ensure that the returned pointer
is non-null.

dereferenceable(<n>)

This indicates that the parameter or return pointer is dereferenceable. This
attribute may only be applied to pointer typed parameters. A pointer that
is dereferenceable can be loaded from speculatively without a risk of
trapping. The number of bytes known to be dereferenceable must be provided
in parentheses. It is legal for the number of bytes to be less than the
size of the pointee type. The nonnull attribute does not imply
dereferenceability (consider a pointer to one element past the end of an
array), however dereferenceable(<n>) does imply nonnull in
addrspace(0) (which is the default address space).

dereferenceable_or_null(<n>)

This indicates that the parameter or return value isn’t both
non-null and non-dereferenceable (up to <n> bytes) at the same
time. All non-null pointers tagged with
dereferenceable_or_null(<n>) are dereferenceable(<n>).
For address space 0 dereferenceable_or_null(<n>) implies that
a pointer is exactly one of dereferenceable(<n>) or null,
and in other address spaces dereferenceable_or_null(<n>)
implies that a pointer is at least one of dereferenceable(<n>)
or null (i.e. it may be both null and
dereferenceable(<n>)). This attribute may only be applied to
pointer typed parameters.

Each function may specify a garbage collector strategy name, which is simply a
string:

definevoid@f()gc"name"{...}

The supported values of name includes those built in to LLVM and any provided by loaded plugins. Specifying a GC
strategy will cause the compiler to alter its output in order to support the
named garbage collection algorithm. Note that LLVM itself does not contain a
garbage collector, this functionality is restricted to generating machine code
which can interoperate with a collector provided externally.

Prefix data is data associated with a function which the code
generator will emit immediately before the function’s entrypoint.
The purpose of this feature is to allow frontends to associate
language-specific runtime metadata with specific functions and make it
available through the function pointer while still allowing the
function pointer to be called.

To access the data for a given function, a program may bitcast the
function pointer to a pointer to the constant’s type and dereference
index -1. This implies that the IR symbol points just past the end of
the prefix data. For instance, take the example of a function annotated
with a single i32,

Prefix data is laid out as if it were an initializer for a global variable
of the prefix data’s type. The function will be placed such that the
beginning of the prefix data is aligned. This means that if the size
of the prefix data is not a multiple of the alignment size, the
function’s entrypoint will not be aligned. If alignment of the
function’s entrypoint is desired, padding must be added to the prefix
data.

A function may have prefix data but no body. This has similar semantics
to the available_externally linkage in that the data may be used by the
optimizers but will not be emitted in the object file.

The prologue attribute allows arbitrary code (encoded as bytes) to
be inserted prior to the function body. This can be used for enabling
function hot-patching and instrumentation.

To maintain the semantics of ordinary function calls, the prologue data must
have a particular format. Specifically, it must begin with a sequence of
bytes which decode to a sequence of machine instructions, valid for the
module’s target, which transfer control to the point immediately succeeding
the prologue data, without performing any other visible action. This allows
the inliner and other passes to reason about the semantics of the function
definition without needing to reason about the prologue data. Obviously this
makes the format of the prologue data highly target dependent.

A trivial example of valid prologue data for the x86 architecture is i8144,
which encodes the nop instruction:

define void @f() prologue i8 144 { ... }

Generally prologue data can be formed by encoding a relative branch instruction
which skips the metadata, as in this example of valid prologue data for the
x86_64 architecture, where the first two bytes encode jmp.+10:

Attribute groups are groups of attributes that are referenced by objects within
the IR. They are important for keeping .ll files readable, because a lot of
functions will use the same set of attributes. In the degenerative case of a
.ll file that corresponds to a single .c file, the single attribute
group will capture the important command line flags used to build that file.

An attribute group is a module-level object. To use an attribute group, an
object references the attribute group’s ID (e.g. #37). An object may refer
to more than one attribute group. In that situation, the attributes from the
different groups are merged.

Here is an example of attribute groups for a function that should always be
inlined, has a stack alignment of 4, and which shouldn’t use SSE instructions:

Function attributes are set to communicate additional information about
a function. Function attributes are considered to be part of the
function, not of the function type, so functions with different function
attributes can have the same function type.

Function attributes are simple keywords that follow the type specified.
If multiple attributes are needed, they are space separated. For
example:

This attribute indicates that, when emitting the prologue and
epilogue, the backend should forcibly align the stack pointer.
Specify the desired alignment, which must be a power of two, in
parentheses.

alwaysinline

This attribute indicates that the inliner should attempt to inline
this function into callers whenever possible, ignoring any active
inlining size threshold for this caller.

builtin

This indicates that the callee function at a call site should be
recognized as a built-in function, even though the function’s declaration
uses the nobuiltin attribute. This is only valid at call sites for
direct calls to functions that are declared with the nobuiltin
attribute.

cold

This attribute indicates that this function is rarely called. When
computing edge weights, basic blocks post-dominated by a cold
function call are also considered to be cold; and, thus, given low
weight.

convergent

This attribute indicates that the callee is dependent on a convergent
thread execution pattern under certain parallel execution models.
Transformations that are execution model agnostic may only move or
tranform this call if the final location is control equivalent to its
original position in the program, where control equivalence is defined as
A dominates B and B post-dominates A, or vice versa.

inlinehint

This attribute indicates that the source code contained a hint that
inlining this function is desirable (such as the “inline” keyword in
C/C++). It is just a hint; it imposes no requirements on the
inliner.

jumptable

This attribute indicates that the function should be added to a
jump-instruction table at code-generation time, and that all address-taken
references to this function should be replaced with a reference to the
appropriate jump-instruction-table function pointer. Note that this creates
a new pointer for the original function, which means that code that depends
on function-pointer identity can break. So, any function annotated with
jumptable must also be unnamed_addr.

minsize

This attribute suggests that optimization passes and code generator
passes make choices that keep the code size of this function as small
as possible and perform optimizations that may sacrifice runtime
performance in order to minimize the size of the generated code.

naked

This attribute disables prologue / epilogue emission for the
function. This can have very system-specific consequences.

nobuiltin

This indicates that the callee function at a call site is not recognized as
a built-in function. LLVM will retain the original call and not replace it
with equivalent code based on the semantics of the built-in function, unless
the call site uses the builtin attribute. This is valid at call sites
and on function declarations and definitions.

noduplicate

This attribute indicates that calls to the function cannot be
duplicated. A call to a noduplicate function may be moved
within its parent function, but may not be duplicated within
its parent function.

A function containing a noduplicate call may still
be an inlining candidate, provided that the call is not
duplicated by inlining. That implies that the function has
internal linkage and only has one call site, so the original
call is dead after inlining.

noimplicitfloat

This attributes disables implicit floating point instructions.

noinline

This attribute indicates that the inliner should never inline this
function in any situation. This attribute may not be used together
with the alwaysinline attribute.

nonlazybind

This attribute suppresses lazy symbol binding for the function. This
may make calls to the function faster, at the cost of extra program
startup time if the function is not called during program startup.

noredzone

This attribute indicates that the code generator should not use a
red zone, even if the target-specific ABI normally permits it.

noreturn

This function attribute indicates that the function never returns
normally. This produces undefined behavior at runtime if the
function ever does dynamically return.

nounwind

This function attribute indicates that the function never raises an
exception. If the function does raise an exception, its runtime
behavior is undefined. However, functions marked nounwind may still
trap or generate asynchronous exceptions. Exception handling schemes
that are recognized by LLVM to handle asynchronous exceptions, such
as SEH, will still provide their implementation defined semantics.

optnone

This function attribute indicates that the function is not optimized
by any optimization or code generator passes with the
exception of interprocedural optimization passes.
This attribute cannot be used together with the alwaysinline
attribute; this attribute is also incompatible
with the minsize attribute and the optsize attribute.

This attribute requires the noinline attribute to be specified on
the function as well, so the function is never inlined into any caller.
Only functions with the alwaysinline attribute are valid
candidates for inlining into the body of this function.

optsize

This attribute suggests that optimization passes and code generator
passes make choices that keep the code size of this function low,
and otherwise do optimizations specifically to reduce code size as
long as they do not significantly impact runtime performance.

readnone

On a function, this attribute indicates that the function computes its
result (or decides to unwind an exception) based strictly on its arguments,
without dereferencing any pointer arguments or otherwise accessing
any mutable state (e.g. memory, control registers, etc) visible to
caller functions. It does not write through any pointer arguments
(including byval arguments) and never changes any state visible
to callers. This means that it cannot unwind exceptions by calling
the C++ exception throwing methods.

On an argument, this attribute indicates that the function does not
dereference that pointer argument, even though it may read or write the
memory that the pointer points to if accessed through other pointers.

readonly

On a function, this attribute indicates that the function does not write
through any pointer arguments (including byval arguments) or otherwise
modify any state (e.g. memory, control registers, etc) visible to
caller functions. It may dereference pointer arguments and read
state that may be set in the caller. A readonly function always
returns the same value (or unwinds an exception identically) when
called with the same set of arguments and global state. It cannot
unwind an exception by calling the C++ exception throwing
methods.

On an argument, this attribute indicates that the function does not write
through this pointer argument, even though it may write to the memory that
the pointer points to.

argmemonly

This attribute indicates that the only memory accesses inside function are
loads and stores from objects pointed to by its pointer-typed arguments,
with arbitrary offsets. Or in other words, all memory operations in the
function can refer to memory only using pointers based on its function
arguments.
Note that argmemonly can be used together with readonly attribute
in order to specify that function reads only from its arguments.

returns_twice

This attribute indicates that this function can return twice. The C
setjmp is an example of such a function. The compiler disables
some optimizations (like tail calls) in the caller of these
functions.

safestack

This attribute indicates that
SafeStack
protection is enabled for this function.

If a function that has a safestack attribute is inlined into a
function that doesn’t have a safestack attribute or which has an
ssp, sspstrong or sspreq attribute, then the resulting
function will have a safestack attribute.

sanitize_address

This attribute indicates that AddressSanitizer checks
(dynamic address safety analysis) are enabled for this function.

sanitize_memory

This attribute indicates that MemorySanitizer checks (dynamic detection
of accesses to uninitialized memory) are enabled for this function.

sanitize_thread

This attribute indicates that ThreadSanitizer checks
(dynamic thread safety analysis) are enabled for this function.

ssp

This attribute indicates that the function should emit a stack
smashing protector. It is in the form of a “canary” — a random value
placed on the stack before the local variables that’s checked upon
return from the function to see if it has been overwritten. A
heuristic is used to determine if a function needs stack protectors
or not. The heuristic used will enable protectors for functions with:

Character arrays larger than ssp-buffer-size (default 8).

Aggregates containing character arrays larger than ssp-buffer-size.

Calls to alloca() with variable sizes or constant sizes greater than
ssp-buffer-size.

Variables that are identified as requiring a protector will be arranged
on the stack such that they are adjacent to the stack protector guard.

If a function that has an ssp attribute is inlined into a
function that doesn’t have an ssp attribute, then the resulting
function will have an ssp attribute.

sspreq

This attribute indicates that the function should always emit a
stack smashing protector. This overrides the ssp function
attribute.

Variables that are identified as requiring a protector will be arranged
on the stack such that they are adjacent to the stack protector guard.
The specific layout rules are:

Large arrays and structures containing large arrays
(>=ssp-buffer-size) are closest to the stack protector.

Small arrays and structures containing small arrays
(<ssp-buffer-size) are 2nd closest to the protector.

Variables that have had their address taken are 3rd closest to the
protector.

If a function that has an sspreq attribute is inlined into a
function that doesn’t have an sspreq attribute or which has an
ssp or sspstrong attribute, then the resulting function will have
an sspreq attribute.

sspstrong

This attribute indicates that the function should emit a stack smashing
protector. This attribute causes a strong heuristic to be used when
determining if a function needs stack protectors. The strong heuristic
will enable protectors for functions with:

Arrays of any size and type

Aggregates containing an array of any size and type.

Calls to alloca().

Local variables that have had their address taken.

Variables that are identified as requiring a protector will be arranged
on the stack such that they are adjacent to the stack protector guard.
The specific layout rules are:

Large arrays and structures containing large arrays
(>=ssp-buffer-size) are closest to the stack protector.

Small arrays and structures containing small arrays
(<ssp-buffer-size) are 2nd closest to the protector.

Variables that have had their address taken are 3rd closest to the
protector.

This overrides the ssp function attribute.

If a function that has an sspstrong attribute is inlined into a
function that doesn’t have an sspstrong attribute, then the
resulting function will have an sspstrong attribute.

"thunk"

This attribute indicates that the function will delegate to some other
function with a tail call. The prototype of a thunk should not be used for
optimization purposes. The caller is expected to cast the thunk prototype to
match the thunk target prototype.

uwtable

This attribute indicates that the ABI being targeted requires that
an unwind table entry be produce for this function even if we can
show that no exceptions passes by it. This is normally the case for
the ELF x86-64 abi, but it can be disabled for some compilation
units.

Modules may contain “module-level inline asm” blocks, which corresponds
to the GCC “file scope inline asm” blocks. These blocks are internally
concatenated by LLVM and treated as a single unit, but may be separated
in the .ll file if desired. The syntax is very simple:

moduleasm"inline asm code goes here"moduleasm"more can go here"

The strings can contain any character by escaping non-printable
characters. The escape sequence used is simply “\xx” where “xx” is the
two digit hex code for the number.

Note that the assembly string must be parseable by LLVM’s integrated assembler
(unless it is disabled), even when emitting a .s file.

A module may specify a target specific data layout string that specifies
how data is to be laid out in memory. The syntax for the data layout is
simply:

targetdatalayout="layout specification"

The layout specification consists of a list of specifications
separated by the minus sign character (‘-‘). Each specification starts
with a letter and may include other information after the letter to
define some aspect of the data layout. The specifications accepted are
as follows:

E

Specifies that the target lays out data in big-endian form. That is,
the bits with the most significance have the lowest address
location.

e

Specifies that the target lays out data in little-endian form. That
is, the bits with the least significance have the lowest address
location.

S<size>

Specifies the natural alignment of the stack in bits. Alignment
promotion of stack variables is limited to the natural stack
alignment to avoid dynamic stack realignment. The stack alignment
must be a multiple of 8-bits. If omitted, the natural stack
alignment defaults to “unspecified”, which does not prevent any
alignment promotions.

p[n]:<size>:<abi>:<pref>

This specifies the size of a pointer and its <abi> and
<pref>erred alignments for address space n. All sizes are in
bits. The address space, n is optional, and if not specified,
denotes the default address space 0. The value of n must be
in the range [1,2^23).

i<size>:<abi>:<pref>

This specifies the alignment for an integer type of a given bit
<size>. The value of <size> must be in the range [1,2^23).

v<size>:<abi>:<pref>

This specifies the alignment for a vector type of a given bit
<size>.

f<size>:<abi>:<pref>

This specifies the alignment for a floating point type of a given bit
<size>. Only values of <size> that are supported by the target
will work. 32 (float) and 64 (double) are supported on all targets; 80
or 128 (different flavors of long double) are also supported on some
targets.

a:<abi>:<pref>

This specifies the alignment for an object of aggregate type.

m:<mangling>

If present, specifies that llvm names are mangled in the output. The
options are

w: Windows COFF prefix: Similar to Mach-O, but stdcall and fastcall
functions also get a suffix based on the frame size.

n<size1>:<size2>:<size3>...

This specifies a set of native integer widths for the target CPU in
bits. For example, it might contain n32 for 32-bit PowerPC,
n32:64 for PowerPC 64, or n8:16:32:64 for X86-64. Elements of
this set are considered to support most general arithmetic operations
efficiently.

On every specification that takes a <abi>:<pref>, specifying the
<pref> alignment is optional. If omitted, the preceding :
should be omitted too and <pref> will be equal to <abi>.

When constructing the data layout for a given target, LLVM starts with a
default set of specifications which are then (possibly) overridden by
the specifications in the datalayout keyword. The default
specifications are given in this list:

E - big endian

p:64:64:64 - 64-bit pointers with 64-bit alignment.

p[n]:64:64:64 - Other address spaces are assumed to be the
same as the default address space.

S0 - natural stack alignment is unspecified

i1:8:8 - i1 is 8-bit (byte) aligned

i8:8:8 - i8 is 8-bit (byte) aligned

i16:16:16 - i16 is 16-bit aligned

i32:32:32 - i32 is 32-bit aligned

i64:32:64 - i64 has ABI alignment of 32-bits but preferred
alignment of 64-bits

f16:16:16 - half is 16-bit aligned

f32:32:32 - float is 32-bit aligned

f64:64:64 - double is 64-bit aligned

f128:128:128 - quad is 128-bit aligned

v64:64:64 - 64-bit vector is 64-bit aligned

v128:128:128 - 128-bit vector is 128-bit aligned

a:0:64 - aggregates are 64-bit aligned

When LLVM is determining the alignment for a given type, it uses the
following rules:

If the type sought is an exact match for one of the specifications,
that specification is used.

If no match is found, and the type sought is an integer type, then
the smallest integer type that is larger than the bitwidth of the
sought type is used. If none of the specifications are larger than
the bitwidth then the largest integer type is used. For example,
given the default specifications above, the i7 type will use the
alignment of i8 (next largest) while both i65 and i256 will use the
alignment of i64 (largest specified).

If no match is found, and the type sought is a vector type, then the
largest vector type that is smaller than the sought vector type will
be used as a fall back. This happens because <128 x double> can be
implemented in terms of 64 <2 x double>, for example.

The function of the data layout string may not be what you expect.
Notably, this is not a specification from the frontend of what alignment
the code generator should use.

Instead, if specified, the target data layout is required to match what
the ultimate code generator expects. This string is used by the
mid-level optimizers to improve code, and this only works if it matches
what the ultimate code generator uses. There is no way to generate IR
that does not embed this target-specific detail into the IR. If you
don’t specify the string, the default specifications will be used to
generate a Data Layout and the optimization phases will operate
accordingly and introduce target specificity into the IR with respect to
these default specifications.

Any memory access must be done through a pointer value associated with
an address range of the memory access, otherwise the behavior is
undefined. Pointer values are associated with address ranges according
to the following rules:

A pointer value is associated with the addresses associated with any
value it is based on.

An address of a global variable is associated with the address range
of the variable’s storage.

The result value of an allocation instruction is associated with the
address range of the allocated storage.

A null pointer in the default address-space is associated with no
address.

An integer constant other than zero or a pointer value returned from
a function not defined within LLVM may be associated with address
ranges allocated through mechanisms other than those provided by
LLVM. Such ranges shall not overlap with any ranges of addresses
allocated by mechanisms provided by LLVM.

A pointer value is based on another pointer value according to the
following rules:

A pointer value formed from a getelementptr operation is based
on the first value operand of the getelementptr.

The result value of a bitcast is based on the operand of the
bitcast.

A pointer value formed by an inttoptr is based on all pointer
values that contribute (directly or indirectly) to the computation of
the pointer’s value.

The “based on” relationship is transitive.

Note that this definition of “based” is intentionally similar to the
definition of “based” in C99, though it is slightly weaker.

LLVM IR does not associate types with memory. The result type of a
load merely indicates the size and alignment of the memory from
which to load, as well as the interpretation of the value. The first
operand type of a store similarly only indicates the size and
alignment of the store.

Consequently, type-based alias analysis, aka TBAA, aka
-fstrict-aliasing, is not applicable to general unadorned LLVM IR.
Metadata may be used to encode additional information
which specialized optimization passes may use to implement type-based
alias analysis.

Certain memory accesses, such as load‘s,
store‘s, and llvm.memcpy‘s may be
marked volatile. The optimizers must not change the number of
volatile operations or change their order of execution relative to other
volatile operations. The optimizers may change the order of volatile
operations relative to non-volatile operations. This is not Java’s
“volatile” and has no cross-thread synchronization behavior.

IR-level volatile loads and stores cannot safely be optimized into
llvm.memcpy or llvm.memmove intrinsics even when those intrinsics are
flagged volatile. Likewise, the backend should never split or merge
target-legal volatile load/store instructions.

Rationale

Platforms may rely on volatile loads and stores of natively supported
data width to be executed as single instruction. For example, in C
this holds for an l-value of volatile primitive type with native
hardware support, but not necessarily for aggregate types. The
frontend upholds these expectations, which are intentionally
unspecified in the IR. The rules above ensure that IR transformation
do not violate the frontend’s contract with the language.

The LLVM IR does not define any way to start parallel threads of
execution or to register signal handlers. Nonetheless, there are
platform-specific ways to create them, and we define LLVM IR’s behavior
in their presence. This model is inspired by the C++0x memory model.

We define a happens-before partial order as the least partial order
that

Is a superset of single-thread program order, and

When a synchronizes-withb, includes an edge from a to
b. Synchronizes-with pairs are introduced by platform-specific
techniques, like pthread locks, thread creation, thread joining,
etc., and by atomic instructions. (See also Atomic Memory Ordering
Constraints).

Note that program order does not introduce happens-before edges
between a thread and signals executing inside that thread.

Every (defined) read operation (load instructions, memcpy, atomic
loads/read-modify-writes, etc.) R reads a series of bytes written by
(defined) write operations (store instructions, atomic
stores/read-modify-writes, memcpy, etc.). For the purposes of this
section, initialized globals are considered to have a write of the
initializer which is atomic and happens before any other read or write
of the memory in question. For each byte of a read R, Rbyte
may see any write to the same byte, except:

If write1 happens before write2, and
write2 happens before Rbyte, then
Rbyte does not see write1.

If Rbyte happens before write3, then
Rbyte does not see write3.

Given that definition, Rbyte is defined as follows:

If R is volatile, the result is target-dependent. (Volatile is
supposed to give guarantees which can support sig_atomic_t in
C/C++, and may be used for accesses to addresses that do not behave
like normal memory. It does not generally provide cross-thread
synchronization.)

Otherwise, if there is no write to the same byte that happens before
Rbyte, Rbyte returns undef for that byte.

Otherwise, if Rbyte may see exactly one write,
Rbyte returns the value written by that write.

Otherwise, if R is atomic, and all the writes Rbyte may
see are atomic, it chooses one of the values written. See the Atomic
Memory Ordering Constraints section for additional
constraints on how the choice is made.

Otherwise Rbyte returns undef.

R returns the value composed of the series of bytes it read. This
implies that some bytes within the value may be undefwithout
the entire value being undef. Note that this only defines the
semantics of the operation; it doesn’t mean that targets will emit more
than one instruction to read the series of bytes.

Note that in cases where none of the atomic intrinsics are used, this
model places only one restriction on IR transformations on top of what
is required for single-threaded execution: introducing a store to a byte
which might not otherwise be stored is not allowed in general.
(Specifically, in the case where another thread might write to and read
from an address, introducing a store can change a load that may see
exactly one write into a load that may see multiple writes.)

Atomic instructions (cmpxchg,
atomicrmw, fence,
atomic load, and atomic store) take
ordering parameters that determine which other atomic instructions on
the same address they synchronize with. These semantics are borrowed
from Java and C++0x, but are somewhat more colloquial. If these
descriptions aren’t precise enough, check those specs (see spec
references in the atomics guide).
fence instructions treat these orderings somewhat
differently since they don’t take an address. See that instruction’s
documentation for details.

The set of values that can be read is governed by the happens-before
partial order. A value cannot be read unless some operation wrote
it. This is intended to provide a guarantee strong enough to model
Java’s non-volatile shared variables. This ordering cannot be
specified for read-modify-write operations; it is not strong enough
to make them atomic in any interesting way.

monotonic

In addition to the guarantees of unordered, there is a single
total order for modifications by monotonic operations on each
address. All modification orders must be compatible with the
happens-before order. There is no guarantee that the modification
orders can be combined to a global total order for the whole program
(and this often will not be possible). The read in an atomic
read-modify-write operation (cmpxchg and
atomicrmw) reads the value in the modification
order immediately before the value it writes. If one atomic read
happens before another atomic read of the same address, the later
read must see the same value or a later value in the address’s
modification order. This disallows reordering of monotonic (or
stronger) operations on the same address. If an address is written
monotonic-ally by one thread, and other threads monotonic-ally
read that address repeatedly, the other threads must eventually see
the write. This corresponds to the C++0x/C1x
memory_order_relaxed.

acquire

In addition to the guarantees of monotonic, a
synchronizes-with edge may be formed with a release operation.
This is intended to model C++’s memory_order_acquire.

release

In addition to the guarantees of monotonic, if this operation
writes a value which is subsequently read by an acquire
operation, it synchronizes-with that operation. (This isn’t a
complete description; see the C++0x definition of a release
sequence.) This corresponds to the C++0x/C1x
memory_order_release.

acq_rel (acquire+release)

Acts as both an acquire and release operation on its
address. This corresponds to the C++0x/C1x memory_order_acq_rel.

seq_cst (sequentially consistent)

In addition to the guarantees of acq_rel (acquire for an
operation that only reads, release for an operation that only
writes), there is a global total order on all
sequentially-consistent operations on all addresses, which is
consistent with the happens-before partial order and with the
modification orders of all the affected addresses. Each
sequentially-consistent read sees the last preceding write to the
same address in this global order. This corresponds to the C++0x/C1x
memory_order_seq_cst and Java volatile.

If an atomic operation is marked singlethread, it only synchronizes
with or participates in modification and seq_cst total orderings with
other operations running in the same thread (for example, in signal
handlers).

Use-list directives encode the in-memory order of each use-list, allowing the
order to be recreated. <order-indexes> is a comma-separated list of
indexes that are assigned to the referenced value’s uses. The referenced
value’s use-list is immediately sorted by these indexes.

Use-list directives may appear at function scope or global scope. They are not
instructions, and have no effect on the semantics of the IR. When they’re at
function scope, they must appear after the terminator of the final basic block.

If basic blocks have their address taken via blockaddress() expressions,
uselistorder_bb can be used to reorder their use-lists from outside their
function’s scope.

The LLVM type system is one of the most important features of the
intermediate representation. Being typed enables a number of
optimizations to be performed on the intermediate representation
directly, without having to do extra analyses on the side before the
transformation. A strong type system makes it easier to read the
generated code and enables novel analyses and transformations that are
not feasible to perform on normal three address code representations.

The function type can be thought of as a function signature. It consists of a
return type and a list of formal parameter types. The return type of a function
type is a void type or first class type — except for label
and metadata types.

Syntax:

<returntype> (<parameter list>)

...where ‘<parameterlist>‘ is a comma-separated list of type
specifiers. Optionally, the parameter list may include a type ..., which
indicates that the function takes a variable number of arguments. Variable
argument functions can access their arguments with the variable argument
handling intrinsic functions. ‘<returntype>‘ is any type
except label and metadata.

Examples:

i32(i32)

function taking an i32, returning an i32

float(i16,i32*)*

Pointer to a function that takes an i16 and a pointer to i32, returning float.

i32(i8*,...)

A vararg function that takes at least one pointer to i8 (char in C), which returns an integer. This is the signature for printf in LLVM.

{i32,i32}(i32)

A function taking an i32, returning a structure containing two i32 values

The x86_mmx type represents a value held in an MMX register on an x86
machine. The operations allowed on it are quite limited: parameters and
return values, load and store, and bitcast. User-specified MMX
instructions are represented as intrinsic or asm calls with arguments
and/or results of this type. There are no arrays, vectors or constants
of this type.

The pointer type is used to specify memory locations. Pointers are
commonly used to reference objects in memory.

Pointer types may have an optional address space attribute defining the
numbered address space where the pointed-to object resides. The default
address space is number zero. The semantics of non-zero address spaces
are target-specific.

Note that LLVM does not permit pointers to void (void*) nor does it
permit pointers to labels (label*). Use i8* instead.

A vector type is a simple derived type that represents a vector of
elements. Vector types are used when multiple primitive data are
operated in parallel using a single instruction (SIMD). A vector type
requires a size (number of elements) and an underlying primitive data
type. Vector types are considered first class.

Syntax:

< <# elements> x <elementtype> >

The number of elements is a constant integer value larger than 0;
elementtype may be any integer, floating point or pointer type. Vectors
of size zero are not allowed.

The array type is a very simple derived type that arranges elements
sequentially in memory. The array type requires a size (number of
elements) and an underlying data type.

Syntax:

[<# elements> x <elementtype>]

The number of elements is a constant integer value; elementtype may
be any type with a size.

Examples:

[40xi32]

Array of 40 32-bit integer values.

[41xi32]

Array of 41 32-bit integer values.

[4xi8]

Array of 4 8-bit integer values.

Here are some examples of multidimensional arrays:

[3x[4xi32]]

3x4 array of 32-bit integer values.

[12x[10xfloat]]

12x10 array of single precision floating point values.

[2x[3x[4xi16]]]

2x3x4 array of 16-bit integer values.

There is no restriction on indexing beyond the end of the array implied
by a static type (though there are restrictions on indexing beyond the
bounds of an allocated object in some cases). This means that
single-dimension ‘variable sized array’ addressing can be implemented in
LLVM with a zero length array type. An implementation of ‘pascal style
arrays’ in LLVM could use the type “{i32,[0xfloat]}”, for
example.

The structure type is used to represent a collection of data members
together in memory. The elements of a structure may be any type that has
a size.

Structures in memory are accessed using ‘load‘ and ‘store‘ by
getting a pointer to a field with the ‘getelementptr‘ instruction.
Structures in registers are accessed using the ‘extractvalue‘ and
‘insertvalue‘ instructions.

Structures may optionally be “packed” structures, which indicate that
the alignment of the struct is one byte, and that there is no padding
between the elements. In non-packed structs, padding between field types
is inserted as defined by the DataLayout string in the module, which is
required to match what the underlying code generator expects.

Structures can either be “literal” or “identified”. A literal structure
is defined inline with other types (e.g. {i32,i32}*) whereas
identified types are always defined at the top level with a name.
Literal types are uniqued by their contents and can never be recursive
or opaque since there is no way to write one. Identified types can be
recursive, can be opaqued, and are never uniqued.

The two strings ‘true‘ and ‘false‘ are both valid constants
of the i1 type.

Integer constants

Standard integers (such as ‘4’) are constants of the
integer type. Negative numbers may be used with
integer types.

Floating point constants

Floating point constants use standard decimal notation (e.g.
123.421), exponential notation (e.g. 1.23421e+2), or a more precise
hexadecimal notation (see below). The assembler requires the exact
decimal value of a floating-point constant. For example, the
assembler accepts 1.25 but rejects 1.3 because 1.3 is a repeating
decimal in binary. Floating point constants must have a floating
point type.

Null pointer constants

The identifier ‘null‘ is recognized as a null pointer constant
and must be of pointer type.

The one non-intuitive notation for constants is the hexadecimal form of
floating point constants. For example, the form
‘double0x432ff973cafa8000‘ is equivalent to (but harder to read
than) ‘double4.5e+15‘. The only time hexadecimal floating point
constants are required (and the only time that they are generated by the
disassembler) is when a floating point constant must be emitted but it
cannot be represented as a decimal floating point number in a reasonable
number of digits. For example, NaN’s, infinities, and other special
values are represented in their IEEE hexadecimal format so that assembly
and disassembly do not cause any bits to change in the constants.

When using the hexadecimal form, constants of types half, float, and
double are represented using the 16-digit form shown above (which
matches the IEEE754 representation for double); half and float values
must, however, be exactly representable as IEEE 754 half and single
precision, respectively. Hexadecimal format is always used for long
double, and there are three forms of long double. The 80-bit format used
by x86 is represented as 0xK followed by 20 hexadecimal digits. The
128-bit format used by PowerPC (two adjacent doubles) is represented by
0xM followed by 32 hexadecimal digits. The IEEE 128-bit format is
represented by 0xL followed by 32 hexadecimal digits. Long doubles
will only work if they match the long double format on your target.
The IEEE 16-bit format (half precision) is represented by 0xH
followed by 4 hexadecimal digits. All hexadecimal formats are big-endian
(sign bit at the left).

Structure constants are represented with notation similar to
structure type definitions (a comma separated list of elements,
surrounded by braces ({})). For example:
“{i324,float17.0,i32*@G}”, where “@G” is declared as
“@G=externalglobali32”. Structure constants must have
structure type, and the number and types of elements
must match those specified by the type.

Array constants

Array constants are represented with notation similar to array type
definitions (a comma separated list of elements, surrounded by
square brackets ([])). For example:
“[i3242,i3211,i3274]”. Array constants must have
array type, and the number and types of elements must
match those specified by the type. As a special case, character array
constants may also be represented as a double-quoted string using the c
prefix. For example: “c"HelloWorld\0A\00"”.

Vector constants

Vector constants are represented with notation similar to vector
type definitions (a comma separated list of elements, surrounded by
less-than/greater-than’s (<>)). For example:
“<i3242,i3211,i3274,i32100>”. Vector constants
must have vector type, and the number and types of
elements must match those specified by the type.

Zero initialization

The string ‘zeroinitializer‘ can be used to zero initialize a
value to zero of any type, including scalar and
aggregate types. This is often used to avoid
having to print large zero initializers (e.g. for large arrays) and
is always exactly equivalent to using explicit zero initializers.

Metadata node

A metadata node is a constant tuple without types. For example:
“!{!0,!{!2,!0},!"test"}”. Metadata can reference constant values,
for example: “!{!0,i320,i8*@global,i64(i64)*@function,!"str"}”.
Unlike other typed constants that are meant to be interpreted as part of
the instruction stream, metadata is a place to attach additional
information such as debug info.

The string ‘undef‘ can be used anywhere a constant is expected, and
indicates that the user of the value may receive an unspecified
bit-pattern. Undefined values may be of any type (other than ‘label‘
or ‘void‘) and be used anywhere a constant is permitted.

Undefined values are useful because they indicate to the compiler that
the program is well defined no matter what value is used. This gives the
compiler more freedom to optimize. Here are some examples of
(potentially surprising) transformations that are valid (in pseudo IR):

This is safe because all of the output bits are affected by the undef
bits. Any output bit can have a zero or one depending on the input bits.

%A=or%X,undef%B=and%X,undefSafe:%A=-1%B=0Unsafe:%A=undef%B=undef

These logical operations have bits that are not always affected by the
input. For example, if %X has a zero bit, then the output of the
‘and‘ operation will always be a zero for that bit, no matter what
the corresponding bit from the ‘undef‘ is. As such, it is unsafe to
optimize or assume that the result of the ‘and‘ is ‘undef‘.
However, it is safe to assume that all bits of the ‘undef‘ could be
0, and optimize the ‘and‘ to 0. Likewise, it is safe to assume that
all the bits of the ‘undef‘ operand to the ‘or‘ could be set,
allowing the ‘or‘ to be folded to -1.

This set of examples shows that undefined ‘select‘ (and conditional
branch) conditions can go either way, but they have to come from one
of the two operands. In the %A example, if %X and %Y were
both known to have a clear low bit, then %A would have to have a
cleared low bit. However, in the %C example, the optimizer is
allowed to assume that the ‘undef‘ operand could be the same as
%Y, allowing the whole ‘select‘ to be eliminated.

This example points out that two ‘undef‘ operands are not
necessarily the same. This can be surprising to people (and also matches
C semantics) where they assume that “X^X” is always zero, even if
X is undefined. This isn’t true for a number of reasons, but the
short answer is that an ‘undef‘ “variable” can arbitrarily change
its value over its “live range”. This is true because the variable
doesn’t actually have a live range. Instead, the value is logically
read from arbitrary registers that happen to be around when needed, so
the value is not necessarily consistent over time. In fact, %A and
%C need to have the same semantics or the core LLVM “replace all
uses with” concept would not hold.

%A=fdivundef,%X%B=fdiv%X,undefSafe:%A=undefb:unreachable

These examples show the crucial difference between an undefined value
and undefined behavior. An undefined value (like ‘undef‘) is
allowed to have an arbitrary bit-pattern. This means that the %A
operation can be constant folded to ‘undef‘, because the ‘undef‘
could be an SNaN, and fdiv is not (currently) defined on SNaN’s.
However, in the second example, we can make a more aggressive
assumption: because the undef is allowed to be an arbitrary value,
we are allowed to assume that it could be zero. Since a divide by zero
has undefined behavior, we are allowed to assume that the operation
does not execute at all. This allows us to delete the divide and all
code after it. Because the undefined operation “can’t happen”, the
optimizer can assume that it occurs in dead code.

These examples reiterate the fdiv example: a store of an undefined
value can be assumed to not have any effect; we can assume that the
value is overwritten with bits that happen to match what was already
there. However, a store to an undefined location could clobber
arbitrary memory, therefore, it has undefined behavior.

Poison values are similar to undef values, however
they also represent the fact that an instruction or constant expression
that cannot evoke side effects has nevertheless detected a condition
that results in undefined behavior.

There is currently no way of representing a poison value in the IR; they
only exist when produced by operations such as add with
the nsw flag.

Phi nodes depend on the operand corresponding to
their dynamic predecessor basic block.

Function arguments depend on the corresponding actual argument values
in the dynamic callers of their functions.

Call instructions depend on the ret
instructions that dynamically transfer control back to them.

Invoke instructions depend on the
ret, resume, or exception-throwing
call instructions that dynamically transfer control back to them.

Non-volatile loads and stores depend on the most recent stores to all
of the referenced memory addresses, following the order in the IR
(including loads and stores implied by intrinsics such as
@llvm.memcpy.)

An instruction with externally visible side effects depends on the
most recent preceding instruction with externally visible side
effects, following the order in the IR. (This includes volatile
operations.)

An instruction control-depends on a terminator
instruction if the terminator instruction has
multiple successors and the instruction is always executed when
control transfers to one of the successors, and may not be executed
when control is transferred to another.

Additionally, an instruction also control-depends on a terminator
instruction if the set of instructions it otherwise depends on would
be different if the terminator had transferred control to a different
successor.

Dependence is transitive.

Poison values have the same behavior as undef values,
with the additional effect that any instruction that has a dependence
on a poison value has undefined behavior.

Here are some examples:

entry:%poison=subnuwi320,1; Results in a poison value.%still_poison=andi32%poison,0; 0, but also poison.%poison_yet_again=getelementptri32,i32*@h,i32%still_poisonstorei320,i32*%poison_yet_again; memory at @h[0] is poisonedstorei32%poison,i32*@g; Poison value stored to memory.%poison2=loadi32,i32*@g; Poison value loaded back from memory.storevolatilei32%poison,i32*@g; External observation; undefined behavior.%narrowaddr=bitcasti32*@gtoi16*%wideaddr=bitcasti32*@gtoi64*%poison3=loadi16,i16*%narrowaddr; Returns a poison value.%poison4=loadi64,i64*%wideaddr; Returns a poison value.%cmp=icmpslti32%poison,0; Returns a poison value.bri1%cmp,label%true,label%end; Branch to either destination.true:storevolatilei320,i32*@g; This is control-dependent on %cmp, so; it has undefined behavior.brlabel%endend:%p=phii32[0,%entry],[1,%true]; Both edges into this PHI are; control-dependent on %cmp, so this; always results in a poison value.storevolatilei320,i32*@g; This would depend on the store in %true; if %cmp is true, or the store in %entry; otherwise, so this is undefined behavior.bri1%cmp,label%second_true,label%second_end; The same branch again, but this time the; true block doesn't have side effects.second_true:; No side effects!retvoidsecond_end:storevolatilei320,i32*@g; This time, the instruction always depends; on the store in %end. Also, it is; control-equivalent to %end, so this is; well-defined (ignoring earlier undefined; behavior in this example).

The ‘blockaddress‘ constant computes the address of the specified
basic block in the specified function, and always has an i8* type.
Taking the address of the entry block is illegal.

This value only has defined behavior when used as an operand to the
‘indirectbr‘ instruction, or for comparisons
against null. Pointer equality tests between labels addresses results in
undefined behavior — though, again, comparison against null is ok, and
no label is equal to the null pointer. This may be passed around as an
opaque pointer sized value as long as the bits are not inspected. This
allows ptrtoint and arithmetic to be performed on these values so
long as the original value is reconstituted before the indirectbr
instruction.

Finally, some targets may provide defined semantics when using the value
as the operand to an inline assembly, but that is target specific.

Constant expressions are used to allow expressions involving other
constants to be used as constants. Constant expressions may be of any
first class type and may involve any LLVM operation
that does not have side effects (e.g. load and call are not supported).
The following is the syntax for constant expressions:

trunc(CSTtoTYPE)

Truncate a constant to another type. The bit size of CST must be
larger than the bit size of TYPE. Both types must be integers.

zext(CSTtoTYPE)

Zero extend a constant to another type. The bit size of CST must be
smaller than the bit size of TYPE. Both types must be integers.

sext(CSTtoTYPE)

Sign extend a constant to another type. The bit size of CST must be
smaller than the bit size of TYPE. Both types must be integers.

fptrunc(CSTtoTYPE)

Truncate a floating point constant to another floating point type.
The size of CST must be larger than the size of TYPE. Both types
must be floating point.

fpext(CSTtoTYPE)

Floating point extend a constant to another type. The size of CST
must be smaller or equal to the size of TYPE. Both types must be
floating point.

fptoui(CSTtoTYPE)

Convert a floating point constant to the corresponding unsigned
integer constant. TYPE must be a scalar or vector integer type. CST
must be of scalar or vector floating point type. Both CST and TYPE
must be scalars, or vectors of the same number of elements. If the
value won’t fit in the integer type, the results are undefined.

fptosi(CSTtoTYPE)

Convert a floating point constant to the corresponding signed
integer constant. TYPE must be a scalar or vector integer type. CST
must be of scalar or vector floating point type. Both CST and TYPE
must be scalars, or vectors of the same number of elements. If the
value won’t fit in the integer type, the results are undefined.

uitofp(CSTtoTYPE)

Convert an unsigned integer constant to the corresponding floating
point constant. TYPE must be a scalar or vector floating point type.
CST must be of scalar or vector integer type. Both CST and TYPE must
be scalars, or vectors of the same number of elements. If the value
won’t fit in the floating point type, the results are undefined.

sitofp(CSTtoTYPE)

Convert a signed integer constant to the corresponding floating
point constant. TYPE must be a scalar or vector floating point type.
CST must be of scalar or vector integer type. Both CST and TYPE must
be scalars, or vectors of the same number of elements. If the value
won’t fit in the floating point type, the results are undefined.

ptrtoint(CSTtoTYPE)

Convert a pointer typed constant to the corresponding integer
constant. TYPE must be an integer type. CST must be of
pointer type. The CST value is zero extended, truncated, or
unchanged to make it fit in TYPE.

inttoptr(CSTtoTYPE)

Convert an integer constant to a pointer constant. TYPE must be a
pointer type. CST must be of integer type. The CST value is zero
extended, truncated, or unchanged to make it fit in a pointer size.
This one is really dangerous!

bitcast(CSTtoTYPE)

Convert a constant, CST, to another TYPE. The constraints of the
operands are the same as those for the bitcast
instruction.

addrspacecast(CSTtoTYPE)

Convert a constant pointer or constant vector of pointer, CST, to another
TYPE in a different address space. The constraints of the operands are the
same as those for the addrspacecast instruction.

Perform the extractvalue operation on
constants. The index list is interpreted in a similar manner as
indices in a ‘getelementptr‘ operation. At
least one index value must be specified.

insertvalue(VAL,ELT,IDX0,IDX1,...)

Perform the insertvalue operation on constants.
The index list is interpreted in a similar manner as indices in a
‘getelementptr‘ operation. At least one index
value must be specified.

OPCODE(LHS,RHS)

Perform the specified operation of the LHS and RHS constants. OPCODE
may be any of the binary or bitwise
binary operations. The constraints on operands are
the same as those for the corresponding instruction (e.g. no bitwise
operations on floating point values are allowed).

LLVM supports inline assembler expressions (as opposed to Module-Level
Inline Assembly) through the use of a special value. This value
represents the inline assembler as a template string (containing the
instructions to emit), a list of operand constraints (stored as a string), a
flag that indicates whether or not the inline asm expression has side effects,
and a flag indicating whether the function containing the asm needs to align its
stack conservatively.

The template string supports argument substitution of the operands using “$”
followed by a number, to indicate substitution of the given register/memory
location, as specified by the constraint string. “${NUM:MODIFIER}” may also
be used, where MODIFIER is a target-specific annotation for how to print the
operand (See Asm template argument modifiers).

A literal “$” may be included by using “$$” in the template. To include
other special characters into the output, the usual “\XX” escapes may be
used, just as in other strings. Note that after template substitution, the
resulting assembly string is parsed by LLVM’s integrated assembler unless it is
disabled – even when emitting a .s file – and thus must contain assembly
syntax known to LLVM.

LLVM’s support for inline asm is modeled closely on the requirements of Clang’s
GCC-compatible inline-asm support. Thus, the feature-set and the constraint and
modifier codes listed here are similar or identical to those in GCC’s inline asm
support. However, to be clear, the syntax of the template and constraint strings
described here is not the same as the syntax accepted by GCC and Clang, and,
while most constraint letters are passed through as-is by Clang, some get
translated to other codes when converting from the C source to the LLVM
assembly.

An example inline assembler expression is:

i32(i32)asm"bswap $0","=r,r"

Inline assembler expressions may only be used as the callee operand
of a call or an invoke instruction.
Thus, typically we have:

%X=calli32asm"bswap $0","=r,r"(i32%Y)

Inline asms with side effects not visible in the constraint list must be
marked as having side effects. This is done through the use of the
‘sideeffect‘ keyword, like so:

callvoidasmsideeffect"eieio",""()

In some cases inline asms will contain code that will not work unless
the stack is aligned in some way, such as calls or SSE instructions on
x86, yet will not contain code that does that alignment within the asm.
The compiler should make conservative assumptions about what the asm
might contain and should generate its usual stack alignment code in the
prologue if the ‘alignstack‘ keyword is present:

call void asm alignstack "eieio", ""()

Inline asms also support using non-standard assembly dialects. The
assumed dialect is ATT. When the ‘inteldialect‘ keyword is present,
the inline asm is using the Intel dialect. Currently, ATT and Intel are
the only supported dialects. An example is:

call void asm inteldialect "eieio", ""()

If multiple keywords appear the ‘sideeffect‘ keyword must come
first, the ‘alignstack‘ keyword second and the ‘inteldialect‘
keyword last.

The constraint list is a comma-separated string, each element containing one or
more constraint codes.

For each element in the constraint list an appropriate register or memory
operand will be chosen, and it will be made available to assembly template
string expansion as $0 for the first constraint in the list, $1 for the
second, etc.

There are three different types of constraints, which are distinguished by a
prefix symbol in front of the constraint code: Output, Input, and Clobber. The
constraints must always be given in that order: outputs first, then inputs, then
clobbers. They cannot be intermingled.

There are also three different categories of constraint codes:

Register constraint. This is either a register class, or a fixed physical
register. This kind of constraint will allocate a register, and if necessary,
bitcast the argument or result to the appropriate type.

Memory constraint. This kind of constraint is for use with an instruction
taking a memory operand. Different constraints allow for different addressing
modes used by the target.

Immediate value constraint. This kind of constraint is for an integer or other
immediate value which can be rendered directly into an instruction. The
various target-specific constraints allow the selection of a value in the
proper range for the instruction you wish to use it with.

Output constraints are specified by an “=” prefix (e.g. “=r”). This
indicates that the assembly will write to this operand, and the operand will
then be made available as a return value of the asm expression. Output
constraints do not consume an argument from the call instruction. (Except, see
below about indirect outputs).

Normally, it is expected that no output locations are written to by the assembly
expression until all of the inputs have been read. As such, LLVM may assign
the same register to an output and an input. If this is not safe (e.g. if the
assembly contains two instructions, where the first writes to one output, and
the second reads an input and writes to a second output), then the “&”
modifier must be used (e.g. “=&r”) to specify that the output is an
“early-clobber” output. Marking an ouput as “early-clobber” ensures that LLVM
will not use the same register for any inputs (other than an input tied to this
output).

Input constraints do not have a prefix – just the constraint codes. Each input
constraint will consume one argument from the call instruction. It is not
permitted for the asm to write to any input register or memory location (unless
that input is tied to an output). Note also that multiple inputs may all be
assigned to the same register, if LLVM can determine that they necessarily all
contain the same value.

Instead of providing a Constraint Code, input constraints may also “tie”
themselves to an output constraint, by providing an integer as the constraint
string. Tied inputs still consume an argument from the call instruction, and
take up a position in the asm template numbering as is usual – they will simply
be constrained to always use the same register as the output they’ve been tied
to. For example, a constraint string of “=r,0” says to assign a register for
output, and use that register as an input as well (it being the 0’th
constraint).

It is permitted to tie an input to an “early-clobber” output. In that case, no
other input may share the same register as the input tied to the early-clobber
(even when the other input has the same value).

You may only tie an input to an output which has a register constraint, not a
memory constraint. Only a single input may be tied to an output.

There is also an “interesting” feature which deserves a bit of explanation: if a
register class constraint allocates a register which is too small for the value
type operand provided as input, the input value will be split into multiple
registers, and all of them passed to the inline asm.

However, this feature is often not as useful as you might think.

Firstly, the registers are not guaranteed to be consecutive. So, on those
architectures that have instructions which operate on multiple consecutive
instructions, this is not an appropriate way to support them. (e.g. the 32-bit
SparcV8 has a 64-bit load, which instruction takes a single 32-bit register. The
hardware then loads into both the named register, and the next register. This
feature of inline asm would not be useful to support that.)

A few of the targets provide a template string modifier allowing explicit access
to the second register of a two-register operand (e.g. MIPS L, M, and
D). On such an architecture, you can actually access the second allocated
register (yet, still, not any subsequent ones). But, in that case, you’re still
probably better off simply splitting the value into two separate operands, for
clarity. (e.g. see the description of the A constraint on X86, which,
despite existing only for use with this feature, is not really a good idea to
use)

Indirect output or input constraints can be specified by the “*” modifier
(which goes after the “=” in case of an output). This indicates that the asm
will write to or read from the contents of an address provided as an input
argument. (Note that in this way, indirect outputs act more like an input than
an output: just like an input, they consume an argument of the call expression,
rather than producing a return value. An indirect output constraint is an
“output” only in that the asm is expected to write to the contents of the input
memory location, instead of just read from it).

This is most typically used for memory constraint, e.g. “=*m”, to pass the
address of a variable as a value.

It is also possible to use an indirect register constraint, but only on output
(e.g. “=*r”). This will cause LLVM to allocate a register for an output
value normally, and then, separately emit a store to the address provided as
input, after the provided inline asm. (It’s not clear what value this
functionality provides, compared to writing the store explicitly after the asm
statement, and it can only produce worse code, since it bypasses many
optimization passes. I would recommend not using it.)

A clobber constraint is indicated by a “~” prefix. A clobber does not
consume an input operand, nor generate an output. Clobbers cannot use any of the
general constraint code letters – they may use only explicit register
constraints, e.g. “~{eax}”. The one exception is that a clobber string of
“~{memory}” indicates that the assembly writes to arbitrary undeclared
memory locations – not only the memory pointed to by a declared indirect
output.

A Constraint Code is either a single letter (e.g. “r”), a “^” character
followed by two letters (e.g. “^wc”), or “{” register-name “}”
(e.g. “{eax}”).

The one and two letter constraint codes are typically chosen to be the same as
GCC’s constraint codes.

A single constraint may include one or more than constraint code in it, leaving
it up to LLVM to choose which one to use. This is included mainly for
compatibility with the translation of GCC inline asm coming from clang.

There are two ways to specify alternatives, and either or both may be used in an
inline asm constraint list:

Append the codes to each other, making a constraint code set. E.g. “im”
or “{eax}m”. This means “choose any of the options in the set”. The
choice of constraint is made independently for each constraint in the
constraint list.

Use “|” between constraint code sets, creating alternatives. Every
constraint in the constraint list must have the same number of alternative
sets. With this syntax, the same alternative in all of the items in the
constraint list will be chosen together.

Putting those together, you might have a two operand constraint string like
"rm|r,ri|rm". This indicates that if operand 0 is r or m, then
operand 1 may be one of r or i. If operand 0 is r, then operand 1
may be one of r or m. But, operand 0 and 1 cannot both be of type m.

However, the use of either of the alternatives features is NOT recommended, as
LLVM is not able to make an intelligent choice about which one to use. (At the
point it currently needs to choose, not enough information is available to do so
in a smart way.) Thus, it simply tries to make a choice that’s most likely to
compile, not one that will be optimal performance. (e.g., given “rm”, it’ll
always choose to use memory, not registers). And, if given multiple registers,
or multiple register classes, it will simply choose the first one. (In fact, it
doesn’t currently even ensure explicitly specified physical registers are
unique, so specifying multiple physical registers as alternatives, like
{r11}{r12},{r11}{r12}, will assign r11 to both operands, not at all what was
intended.)

The constraint codes are, in general, expected to behave the same way they do in
GCC. LLVM’s support is often implemented on an ‘as-needed’ basis, to support C
inline asm code which was supported by GCC. A mismatch in behavior between LLVM
and GCC likely indicates a bug in LLVM.

i: An integer constant (of target-specific width). Allows either a simple
immediate, or a relocatable value.

n: An integer constant – not including relocatable values.

s: An integer constant, but allowing only relocatable values.

X: Allows an operand of any kind, no constraint whatsoever. Typically
useful to pass a label for an asm branch or call.

{register-name}: Requires exactly the named physical register.

Other constraints are target-specific:

AArch64:

z: An immediate integer 0. Outputs WZR or XZR, as appropriate.

I: An immediate integer valid for an ADD or SUB instruction,
i.e. 0 to 4095 with optional shift by 12.

J: An immediate integer that, when negated, is valid for an ADD or
SUB instruction, i.e. -1 to -4095 with optional left shift by 12.

K: An immediate integer that is valid for the ‘bitmask immediate 32’ of a
logical instruction like AND, EOR, or ORR with a 32-bit register.

L: An immediate integer that is valid for the ‘bitmask immediate 64’ of a
logical instruction like AND, EOR, or ORR with a 64-bit register.

M: An immediate integer for use with the MOV assembly alias on a
32-bit register. This is a superset of K: in addition to the bitmask
immediate, also allows immediate integers which can be loaded with a single
MOVZ or MOVL instruction.

N: An immediate integer for use with the MOV assembly alias on a
64-bit register. This is a superset of L.

Q: Memory address operand must be in a single register (no
offsets). (However, LLVM currently does this for the m constraint as
well.)

q: An 8, 16, 32, or 64-bit register which can be accessed as an 8-bit
l integer register. On X86-32, this is the a, b, c, and d
registers, and on X86-64, it is all of the integer registers.

Q: An 8, 16, 32, or 64-bit register which can be accessed as an 8-bit
h integer register. This is the a, b, c, and d registers.

r or l: An 8, 16, 32, or 64-bit integer register.

R: An 8, 16, 32, or 64-bit “legacy” integer register – one which has
existed since i386, and can be accessed without the REX prefix.

f: A 32, 64, or 80-bit ‘387 FPU stack pseudo-register.

y: A 64-bit MMX register, if MMX is enabled.

x: If SSE is enabled: a 32 or 64-bit scalar operand, or 128-bit vector
operand in a SSE register. If AVX is also enabled, can also be a 256-bit
vector operand in an AVX register. If AVX-512 is also enabled, can also be a
512-bit vector operand in an AVX512 register, Otherwise, an error.

Y: The same as x, if SSE2 is enabled, otherwise an error.

A: Special case: allocates EAX first, then EDX, for a single operand (in
32-bit mode, a 64-bit integer operand will get split into two registers). It
is not recommended to use this constraint, as in 64-bit mode, the 64-bit
operand will get allocated only to RAX – if two 32-bit operands are needed,
you’re better off splitting it yourself, before passing it to the asm
statement.

In the asm template string, modifiers can be used on the operand reference, like
“${0:n}”.

The modifiers are, in general, expected to behave the same way they do in
GCC. LLVM’s support is often implemented on an ‘as-needed’ basis, to support C
inline asm code which was supported by GCC. A mismatch in behavior between LLVM
and GCC likely indicates a bug in LLVM.

M: Print as a register set suitable for ldm/stm. Also prints all
register operands subsequent to the specified one (!), so use carefully.

Q: Print the low-order register of a register-pair, or the low-order
register of a two-register operand.

R: Print the high-order register of a register-pair, or the high-order
register of a two-register operand.

H: Print the second register of a register-pair. (On a big-endian system,
H is equivalent to Q, and on little-endian system, H is equivalent
to R.)

e: Print the low doubleword register of a NEON quad register.

f: Print the high doubleword register of a NEON quad register.

m: Print the base register of a memory operand without the [ and ]
adornment.

Hexagon:

L: Print the second register of a two-register operand. Requires that it
has been allocated consecutively to the first.

I: Print the letter ‘i’ if the operand is an integer constant, otherwise
nothing. Used to print ‘addi’ vs ‘add’ instructions.

MSP430:

No additional modifiers.

MIPS:

X: Print an immediate integer as hexadecimal

x: Print the low 16 bits of an immediate integer as hexadecimal.

d: Print an immediate integer as decimal.

m: Subtract one and print an immediate integer as decimal.

z: Print $0 if an immediate zero, otherwise print normally.

L: Print the low-order register of a two-register operand, or prints the
address of the low-order word of a double-word memory operand.

M: Print the high-order register of a two-register operand, or prints the
address of the high-order word of a double-word memory operand.

D: Print the second register of a two-register operand, or prints the
second word of a double-word memory operand. (On a big-endian system, D is
equivalent to L, and on little-endian system, D is equivalent to
M.)

w: No effect. Provided for compatibility with GCC which requires this
modifier in order to print MSA registers (W0-W31) with the f
constraint.

NVPTX:

r: No effect.

PowerPC:

L: Print the second register of a two-register operand. Requires that it
has been allocated consecutively to the first.

I: Print the letter ‘i’ if the operand is an integer constant, otherwise
nothing. Used to print ‘addi’ vs ‘add’ instructions.

U: Prints ‘u’ if the memory operand is an update form, and nothing
otherwise. (NOTE: LLVM does not support update form, so this will currently
always print nothing)

X: Prints ‘x’ if the memory operand is an indexed form. (NOTE: LLVM does
not support indexed form, so this will currently always print nothing)

Sparc:

r: No effect.

SystemZ:

SystemZ implements only n, and does not support any of the other
target-independent modifiers.

X86:

c: Print an unadorned integer or symbol name. (The latter is
target-specific behavior for this typically target-independent modifier).

A: Print a register name with a ‘*‘ before it.

b: Print an 8-bit register name (e.g. al); do nothing on a memory
operand.

h: Print the upper 8-bit register name (e.g. ah); do nothing on a
memory operand.

w: Print the 16-bit register name (e.g. ax); do nothing on a memory
operand.

k: Print the 32-bit register name (e.g. eax); do nothing on a memory
operand.

q: Print the 64-bit register name (e.g. rax), if 64-bit registers are
available, otherwise the 32-bit register name; do nothing on a memory operand.

n: Negate and print an unadorned integer, or, for operands other than an
immediate integer (e.g. a relocatable symbol expression), print a ‘-‘ before
the operand. (The behavior for relocatable symbol expressions is a
target-specific behavior for this typically target-independent modifier)

H: Print a memory reference with additional offset +8.

P: Print a memory reference or operand for use as the argument of a call
instruction. (E.g. omit (rip), even though it’s PC-relative.)

The call instructions that wrap inline asm nodes may have a
“!srcloc” MDNode attached to it that contains a list of constant
integers. If present, the code generator will use the integer as the
location cookie value when report errors through the LLVMContext
error reporting mechanisms. This allows a front-end to correlate backend
errors that occur with inline asm back to the source code that produced
it. For example:

It is up to the front-end to make sense of the magic numbers it places
in the IR. If the MDNode contains multiple constants, the code generator
will use the one that corresponds to the line of the asm that the error
occurs on.

LLVM IR allows metadata to be attached to instructions in the program
that can convey extra information about the code to the optimizers and
code generator. One example application of metadata is source-level
debug information. There are two metadata primitives: strings and nodes.

Metadata does not have a type, and is not a value. If referenced from a
call instruction, it uses the metadata type.

A metadata string is a string surrounded by double quotes. It can
contain any character by escaping non-printable characters with
“\xx” where “xx” is the two digit hex code. For example:
“!"test\00"”.

Metadata nodes are represented with notation similar to structure
constants (a comma separated list of elements, surrounded by braces and
preceded by an exclamation point). Metadata nodes can have any values as
their operand. For example:

!{!"test\00",i3210}

Metadata nodes that aren’t uniqued use the distinct keyword. For example:

!0 = distinct !{!"test\00", i32 10}

distinct nodes are useful when nodes shouldn’t be merged based on their
content. They can also occur when transformations cause uniquing collisions
when metadata operands change.

A named metadata is a collection of
metadata nodes, which can be looked up in the module symbol table. For
example:

!foo=!{!4,!3}

Metadata can be used as function arguments. Here llvm.dbg.value
function is using two metadata arguments:

callvoid@llvm.dbg.value(metadata!24,i640,metadata!25)

Metadata can be attached with an instruction. Here metadata !21 is
attached to the add instruction using the !dbg identifier:

%indvar.next=addi64%indvar,1,!dbg!21

More information about specific metadata nodes recognized by the
optimizers and code generator is found below.

DICompileUnit nodes represent a compile unit. The enums:,
retainedTypes:, subprograms:, globals: and imports: fields are
tuples containing the debug info to be emitted along with the compile unit,
regardless of code optimizations (some nodes are only emitted if there are
references to them from instructions).

Compile unit descriptors provide the root scope for objects declared in a
specific compilation unit. File descriptors are defined using this scope.
These descriptors are collected by a named metadata !llvm.dbg.cu. They
keep track of subprograms, global variables, type information, and imported
entities (declarations and namespaces).

DISubroutineType nodes represent subroutine types. Their types: field
refers to a tuple; the first operand is the return type, while the rest are the
types of the formal arguments in order. If the first operand is null, that
represents a function with no return value (such as voidfoo(){} in C++).

DW_TAG_member is used to define a member of a composite type or subprogram. The type of the member
is the baseType:. The offset: is the member’s bit offset.
DW_TAG_formal_parameter is used to define a member which is a formal
argument of a subprogram.

DW_TAG_typedef is used to provide a name for the baseType:.

DW_TAG_pointer_type, DW_TAG_reference_type, DW_TAG_const_type,
DW_TAG_volatile_type and DW_TAG_restrict_type are used to qualify the
baseType:.

DICompositeType nodes represent types composed of other types, like
structures and unions. elements: points to a tuple of the composed types.

If the source language supports ODR, the identifier: field gives the unique
identifier used for type merging between modules. When specified, other types
can refer to composite types indirectly via a metadata string that matches their identifier.

For DW_TAG_array_type, the elements: should be subrange
descriptors, each representing the range of subscripts at that
level of indexing. The DIFlagVector flag to flags: indicates that an
array type is a native packed vector.

For DW_TAG_enumeration_type, the elements: should be enumerator
descriptors, each representing the definition of an enumeration
value for the set. All enumeration type descriptors are collected in the
enums: field of the compile unit.

For DW_TAG_structure_type, DW_TAG_class_type, and
DW_TAG_union_type, the elements: should be derived types with tag:DW_TAG_member or tag:DW_TAG_inheritance.

DITemplateValueParameter nodes represent value parameters to generic source
language constructs. tag: defaults to DW_TAG_template_value_parameter,
but if specified can also be set to DW_TAG_GNU_template_template_param or
DW_TAG_GNU_template_param_pack. They are used (optionally) in
DICompositeType and DISubprogramtemplateParams: fields.

DISubprogram nodes represent functions from the source language. The
variables: field points at variables that must be
retained, even if their IR counterparts are optimized out of the IR. The
type: field must point at an DISubroutineType.

DILexicalBlockFile nodes are used to discriminate between sections of a
lexical block. The file: field can be changed to
indicate textual inclusion, or the discriminator: field can be used to
discriminate between control flow within a single block in the source language.

DILocalVariable nodes represent local variables in the source language.
Instead of DW_TAG_variable, they use LLVM-specific fake tags to
discriminate between local variables (DW_TAG_auto_variable) and subprogram
arguments (DW_TAG_arg_variable). In the latter case, the arg: field
specifies the argument position, and this variable will be included in the
variables: field of its DISubprogram.

DIExpression nodes represent DWARF expression sequences. They are used in
debug intrinsics (such as llvm.dbg.declare) to
describe how the referenced LLVM variable relates to the source language
variable.

The current supported vocabulary is limited:

DW_OP_deref dereferences the working expression.

DW_OP_plus,93 adds 93 to the working expression.

DW_OP_bit_piece,16,8 specifies the offset and size (16 and 8
here, respectively) of the variable piece from the working expression.

In LLVM IR, memory does not have types, so LLVM’s own type system is not
suitable for doing TBAA. Instead, metadata is added to the IR to
describe a type system of a higher level language. This can be used to
implement typical C/C++ TBAA, but it can also be used to implement
custom alias analysis behavior for other languages.

The current metadata format is very simple. TBAA metadata nodes have up
to three fields, e.g.:

The first field is an identity field. It can be any value, usually a
metadata string, which uniquely identifies the type. The most important
name in the tree is the name of the root node. Two trees with different
root node names are entirely disjoint, even if they have leaves with
common names.

The second field identifies the type’s parent node in the tree, or is
null or omitted for a root node. A type is considered to alias all of
its descendants and all of its ancestors in the tree. Also, a type is
considered to alias all types in other trees, so that bitcode produced
from multiple front-ends is handled conservatively.

If the third field is present, it’s an integer which if equal to 1
indicates that the type is “constant” (meaning
pointsToConstantMemory should return true; see other useful
AliasAnalysis methods).

The llvm.memcpy is often used to implement
aggregate assignment operations in C and similar languages, however it
is defined to copy a contiguous region of memory, which is more than
strictly necessary for aggregate types which contain holes due to
padding. Also, it doesn’t contain any TBAA information about the fields
of the aggregate.

!tbaa.struct metadata can describe which memory subregions in a
memcpy are padding and what the TBAA tags of the struct are.

The current metadata format is very simple. !tbaa.struct metadata
nodes are a list of operands which are in conceptual groups of three.
For each group of three, the first operand gives the byte offset of a
field in bytes, the second gives its size in bytes, and the third gives
its tbaa tag. e.g.:

!4=!{i640,i644,!1,i648,i644,!2}

This describes a struct with two fields. The first is at offset 0 bytes
with size 4 bytes, and has tbaa tag !1. The second is at offset 8 bytes
and has size 4 bytes and has tbaa tag !2.

Note that the fields need not be contiguous. In this example, there is a
4 byte gap between the two fields. This gap represents padding which
does not carry useful data and need not be preserved.

noalias and alias.scope metadata provide the ability to specify generic
noalias memory-access sets. This means that some collection of memory access
instructions (loads, stores, memory-accessing calls, etc.) that carry
noalias metadata can specifically be specified not to alias with some other
collection of memory access instructions that carry alias.scope metadata.
Each type of metadata specifies a list of scopes where each scope has an id and
a domain. When evaluating an aliasing query, if for some domain, the set
of scopes with that domain in one instruction’s alias.scope list is a
subset of (or equal to) the set of scopes for that domain in another
instruction’s noalias list, then the two memory accesses are assumed not to
alias.

The metadata identifying each domain is itself a list containing one or two
entries. The first entry is the name of the domain. Note that if the name is a
string then it can be combined accross functions and translation units. A
self-reference can be used to create globally unique domain names. A
descriptive string may optionally be provided as a second list entry.

The metadata identifying each scope is also itself a list containing two or
three entries. The first entry is the name of the scope. Note that if the name
is a string then it can be combined accross functions and translation units. A
self-reference can be used to create globally unique scope names. A metadata
reference to the scope’s domain is the second entry. A descriptive string may
optionally be provided as a third list entry.

For example,

; Two scope domains:!0=!{!0}!1=!{!1}; Some scopes in these domains:!2=!{!2,!0}!3=!{!3,!0}!4=!{!4,!1}; Some scope lists:!5=!{!4}; A list containing only scope !4!6=!{!4,!3,!2}!7=!{!3}; These two instructions don't alias:%0=loadfloat,float*%c,align4,!alias.scope!5storefloat%0,float*%arrayidx.i,align4,!noalias!5; These two instructions also don't alias (for domain !1, the set of scopes; in the !alias.scope equals that in the !noalias list):%2=loadfloat,float*%c,align4,!alias.scope!5storefloat%2,float*%arrayidx.i2,align4,!noalias!6; These two instructions may alias (for domain !0, the set of scopes in; the !noalias list is not a superset of, or equal to, the scopes in the; !alias.scope list):%2=loadfloat,float*%c,align4,!alias.scope!6storefloat%0,float*%arrayidx.i,align4,!noalias!7

fpmath metadata may be attached to any instruction of floating point
type. It can be used to express the maximum acceptable error in the
result of that instruction, in ULPs, thus potentially allowing the
compiler to use a more efficient but less accurate method of computing
it. ULP is defined as follows:

If x is a real number that lies between two finite consecutive
floating-point numbers a and b, without being equal to one
of them, then ulp(x)=|b-a|, otherwise ulp(x) is the
distance between the two non-equal finite floating-point numbers
nearest x. Moreover, ulp(NaN) is NaN.

The metadata node shall consist of a single positive floating point
number representing the maximum relative error, for example:

range metadata may be attached only to load, call and invoke of
integer types. It expresses the possible ranges the loaded value or the value
returned by the called function at this call site is in. The ranges are
represented with a flattened list of integers. The loaded value or the value
returned is known to be in the union of the ranges defined by each consecutive
pair. Each pair has the following properties:

The type must match the type loaded by the instruction.

The pair a,b represents the range [a,b).

Both a and b are constants.

The range is allowed to wrap.

The range should not represent the full or empty set. That is,
a!=b.

In addition, the pairs must be in signed order of the lower bound and
they must be non-contiguous.

Examples:

%a=loadi8,i8*%x,align1,!range!0; Can only be 0 or 1%b=loadi8,i8*%y,align1,!range!1; Can only be 255 (-1), 0 or 1%c=calli8@foo(),!range!2; Can only be 0, 1, 3, 4 or 5%d=invokei8@bar()tolabel%contunwindlabel%lpad,!range!3; Can only be -2, -1, 3, 4 or 5...!0=!{i80,i82}!1=!{i8255,i82}!2=!{i80,i82,i83,i86}!3=!{i8-2,i80,i83,i86}

It is sometimes useful to attach information to loop constructs. Currently,
loop metadata is implemented as metadata attached to the branch instruction
in the loop latch block. This type of metadata refer to a metadata node that is
guaranteed to be separate for each loop. The loop identifier metadata is
specified with the name llvm.loop.

The loop identifier metadata is implemented using a metadata that refers to
itself to avoid merging it with any other identifier metadata, e.g.,
during module linkage or function inlining. That is, each loop should refer
to their own identification metadata even if they reside in separate functions.
The following example contains loop identifier metadata for two separate loop
constructs:

!0=!{!0}!1=!{!1}

The loop identifier metadata can be used to specify additional
per-loop metadata. Any operands after the first operand can be treated
as user-defined metadata. For example the llvm.loop.unroll.count
suggests an unroll factor to the loop unroller:

Metadata prefixed with llvm.loop.vectorize or llvm.loop.interleave are
used to control per-loop vectorization and interleaving parameters such as
vectorization width and interleave count. These metadata should be used in
conjunction with llvm.loop loop identification metadata. The
llvm.loop.vectorize and llvm.loop.interleave metadata are only
optimization hints and the optimizer will only interleave and vectorize loops if
it believes it is safe to do so. The llvm.mem.parallel_loop_access metadata
which contains information about loop-carried memory dependencies can be helpful
in determining the safety of these transformations.

This metadata suggests an interleave count to the loop interleaver.
The first operand is the string llvm.loop.interleave.count and the
second operand is an integer specifying the interleave count. For
example:

!0=!{!"llvm.loop.interleave.count",i324}

Note that setting llvm.loop.interleave.count to 1 disables interleaving
multiple iterations of the loop. If llvm.loop.interleave.count is set to 0
then the interleave count will be determined automatically.

This metadata selectively enables or disables vectorization for the loop. The
first operand is the string llvm.loop.vectorize.enable and the second operand
is a bit. If the bit operand value is 1 vectorization is enabled. A value of
0 disables vectorization:

This metadata sets the target width of the vectorizer. The first
operand is the string llvm.loop.vectorize.width and the second
operand is an integer specifying the width. For example:

!0=!{!"llvm.loop.vectorize.width",i324}

Note that setting llvm.loop.vectorize.width to 1 disables
vectorization of the loop. If llvm.loop.vectorize.width is set to
0 or if the loop does not have this metadata the width will be
determined automatically.

Metadata prefixed with llvm.loop.unroll are loop unrolling
optimization hints such as the unroll factor. llvm.loop.unroll
metadata should be used in conjunction with llvm.loop loop
identification metadata. The llvm.loop.unroll metadata are only
optimization hints and the unrolling will only be performed if the
optimizer believes it is safe to do so.

This metadata suggests an unroll factor to the loop unroller. The
first operand is the string llvm.loop.unroll.count and the second
operand is a positive integer specifying the unroll factor. For
example:

!0=!{!"llvm.loop.unroll.count",i324}

If the trip count of the loop is less than the unroll count the loop
will be partially unrolled.

The llvm.mem.parallel_loop_access metadata refers to a loop identifier,
or metadata containing a list of loop identifiers for nested loops.
The metadata is attached to memory accessing instructions and denotes that
no loop carried memory dependence exist between it and other instructions denoted
with the same loop identifier.

Precisely, given two instructions m1 and m2 that both have the
llvm.mem.parallel_loop_access metadata, with L1 and L2 being the
set of loops associated with that metadata, respectively, then there is no loop
carried dependence between m1 and m2 for loops in both L1 and
L2.

As a special case, if all memory accessing instructions in a loop have
llvm.mem.parallel_loop_access metadata that refers to that loop, then the
loop has no loop carried memory dependences and is considered to be a parallel
loop.

Note that if not all memory access instructions have such metadata referring to
the loop, then the loop is considered not being trivially parallel. Additional
memory dependence analysis is required to make that determination. As a fail
safe mechanism, this causes loops that were originally parallel to be considered
sequential (if optimization passes that are unaware of the parallel semantics
insert new memory instructions into the loop body).

Example of a loop that is considered parallel due to its correct use of
both llvm.loop and llvm.mem.parallel_loop_access
metadata types that refer to the same loop identifier metadata.

It is also possible to have nested parallel loops. In that case the
memory accesses refer to a list of loop identifier metadata nodes instead of
the loop identifier metadata node directly:

outer.for.body:...%val1=loadi32,i32*%arrayidx3,!llvm.mem.parallel_loop_access!2...brlabel%inner.for.bodyinner.for.body:...%val0=loadi32,i32*%arrayidx1,!llvm.mem.parallel_loop_access!0...storei32%val0,i32*%arrayidx2,!llvm.mem.parallel_loop_access!0...bri1%exitcond,label%inner.for.end,label%inner.for.body,!llvm.loop!1inner.for.end:...storei32%val1,i32*%arrayidx4,!llvm.mem.parallel_loop_access!2...bri1%exitcond,label%outer.for.end,label%outer.for.body,!llvm.loop!2outer.for.end:; preds = %for.body...!0=!{!1,!2}; a list of loop identifiers!1=!{!1}; an identifier for the inner loop!2=!{!2}; an identifier for the outer loop

Information about the module as a whole is difficult to convey to LLVM’s
subsystems. The LLVM IR isn’t sufficient to transmit this information.
The llvm.module.flags named metadata exists in order to facilitate
this. These flags are in the form of key / value pairs — much like a
dictionary — making it easy for any subsystem who cares about a flag to
look it up.

The llvm.module.flags metadata contains a list of metadata triplets.
Each triplet has the following form:

The first element is a behavior flag, which specifies the behavior
when two (or more) modules are merged together, and it encounters two
(or more) metadata with the same ID. The supported behaviors are
described below.

The second element is a metadata string that is a unique ID for the
metadata. Each module may only have one flag entry for each unique ID (not
including entries with the Require behavior).

The third element is the value of the flag.

When two (or more) modules are merged together, the resulting
llvm.module.flags metadata is the union of the modules’ flags. That is, for
each unique metadata ID string, there will be exactly one entry in the merged
modules llvm.module.flags metadata table, and the value for that entry will
be determined by the merge behavior flag, as described below. The only exception
is that entries with the Require behavior are always preserved.

The following behaviors are supported:

Value

Behavior

1

Error

Emits an error if two values disagree, otherwise the resulting value
is that of the operands.

2

Warning

Emits a warning if two values disagree. The result value will be the
operand for the flag from the first module being linked.

3

Require

Adds a requirement that another module flag be present and have a
specified value after linking is performed. The value must be a
metadata pair, where the first element of the pair is the ID of the
module flag to be restricted, and the second element of the pair is
the value the module flag should be restricted to. This behavior can
be used to restrict the allowable results (via triggering of an
error) of linking IDs with the Override behavior.

4

Override

Uses the specified value, regardless of the behavior or value of the
other module. If both modules specify Override, but the values
differ, an error will be emitted.

5

Append

Appends the two values, which are required to be metadata nodes.

6

AppendUnique

Appends the two values, which are required to be metadata
nodes. However, duplicate entries in the second list are dropped
during the append operation.

It is an error for a particular unique flag ID to have multiple behaviors,
except in the case of Require (which adds restrictions on another metadata
value) or Override.

On the Mach-O platform, Objective-C stores metadata about garbage
collection in a special section called “image info”. The metadata
consists of a version number and a bitmask specifying what types of
garbage collection are supported (if any) by the file. If two or more
modules are linked together their garbage collection metadata needs to
be merged rather than appended together.

The Objective-C garbage collection module flags metadata consists of the
following key-value pairs:

Key

Value

Objective-CVersion

[Required] — The Objective-C ABI version. Valid values are 1 and 2.

Objective-CImageInfoVersion

[Required] — The version of the image info section. Currently
always 0.

Objective-CImageInfoSection

[Required] — The section to place the metadata. Valid values are
"__OBJC,__image_info,regular" for Objective-C ABI version 1, and
"__DATA,__objc_imageinfo,regular,no_dead_strip" for
Objective-C ABI version 2.

Some targets support embedding flags to the linker inside individual object
files. Typically this is used in conjunction with language extensions which
allow source files to explicitly declare the libraries they depend on, and have
these automatically be transmitted to the linker via object files.

These flags are encoded in the IR using metadata in the module flags section,
using the LinkerOptions key. The merge behavior for this flag is required
to be AppendUnique, and the value for the key is expected to be a metadata
node which should be a list of other metadata nodes, each of which should be a
list of metadata strings defining linker options.

For example, the following metadata section specifies two separate sets of
linker options, presumably to link against libz and the Cocoa
framework:

The metadata encoding as lists of lists of options, as opposed to a collapsed
list of options, is chosen so that the IR encoding can use multiple option
strings to specify e.g., a single library, while still having that specifier be
preserved as an atomic element that can be recognized by a target specific
assembly writer or object file emitter.

Each individual option is required to be either a valid option for the target’s
linker, or an option that is reserved by the target specific assembly writer or
object file emitter. No other aspect of these options is defined by the IR.

The ARM backend emits a section into each generated object file describing the
options that it was compiled with (in a compiler-independent way) to prevent
linking incompatible objects, and to allow automatic library selection. Some
of these options are not visible at the IR level, namely wchar_t width and enum
width.

To pass this information to the backend, these options are encoded in module
flags metadata, using the following key-value pairs:

Key

Value

short_wchar

0 — sizeof(wchar_t) == 4

1 — sizeof(wchar_t) == 2

short_enum

0 — Enums are at least as large as an int.

1 — Enums are stored in the smallest integer type which can
represent all of its values.

For example, the following metadata section specifies that the module was
compiled with a wchar_t width of 4 bytes, and the underlying type of an
enum is the smallest type which can represent all of its values:

LLVM has a number of “magic” global variables that contain data that
affect code generation or other IR semantics. These are documented here.
All globals of this sort should have a section specified as
“llvm.metadata”. This section and all globals that start with
“llvm.” are reserved for use by LLVM.

The @llvm.used global is an array which has
appending linkage. This array contains a list of
pointers to named global variables, functions and aliases which may optionally
have a pointer cast formed of bitcast or getelementptr. For example, a legal
use of it is:

If a symbol appears in the @llvm.used list, then the compiler, assembler,
and linker are required to treat the symbol as if there is a reference to the
symbol that it cannot see (which is why they have to be named). For example, if
a variable has internal linkage and no references other than that from the
@llvm.used list, it cannot be deleted. This is commonly used to represent
references from inline asms and other things the compiler cannot “see”, and
corresponds to “attribute((used))” in GNU C.

On some targets, the code generator must emit a directive to the
assembler or object file to prevent the assembler and linker from
molesting the symbol.

The @llvm.compiler.used directive is the same as the @llvm.used
directive, except that it only prevents the compiler from touching the
symbol. On targets that support it, this allows an intelligent linker to
optimize references to the symbol without being impeded as it would be
by @llvm.used.

This is a rare construct that should only be used in rare circumstances,
and should not be exposed to source languages.

The @llvm.global_ctors array contains a list of constructor
functions, priorities, and an optional associated global or function.
The functions referenced by this array will be called in ascending order
of priority (i.e. lowest first) when the module is loaded. The order of
functions with the same priority is not defined.

If the third field is present, non-null, and points to a global variable
or function, the initializer function will only run if the associated
data from the current module is not discarded.

The @llvm.global_dtors array contains a list of destructor
functions, priorities, and an optional associated global or function.
The functions referenced by this array will be called in descending
order of priority (i.e. highest first) when the module is unloaded. The
order of functions with the same priority is not defined.

If the third field is present, non-null, and points to a global variable
or function, the destructor function will only run if the associated
data from the current module is not discarded.

As mentioned previously, every basic block in a
program ends with a “Terminator” instruction, which indicates which
block should be executed after the current block is finished. These
terminator instructions typically yield a ‘void‘ value: they produce
control flow, not values (the one exception being the
‘invoke‘ instruction).

The ‘ret‘ instruction optionally accepts a single argument, the
return value. The type of the return value must be a ‘first
class‘ type.

A function is not well formed if it it has a non-void
return type and contains a ‘ret‘ instruction with no return value or
a return value with a type that does not match its type, or if it has a
void return type and contains a ‘ret‘ instruction with a return
value.

When the ‘ret‘ instruction is executed, control flow returns back to
the calling function’s context. If the caller is a
“call” instruction, execution continues at the
instruction after the call. If the caller was an
“invoke” instruction, execution continues at the
beginning of the “normal” destination block. If the instruction returns
a value, that value shall set the call or invoke instruction’s return
value.

The ‘br‘ instruction is used to cause control flow to transfer to a
different basic block in the current function. There are two forms of
this instruction, corresponding to a conditional branch and an
unconditional branch.

Upon execution of a conditional ‘br‘ instruction, the ‘i1‘
argument is evaluated. If the value is true, control flows to the
‘iftrue‘ label argument. If “cond” is false, control flows
to the ‘iffalse‘ label argument.

The ‘switch‘ instruction is used to transfer control flow to one of
several different places. It is a generalization of the ‘br‘
instruction, allowing a branch to occur to one of many possible
destinations.

The ‘switch‘ instruction uses three parameters: an integer
comparison value ‘value‘, a default ‘label‘ destination, and an
array of pairs of comparison value constants and ‘label‘s. The table
is not allowed to contain duplicate constant entries.

The switch instruction specifies a table of values and destinations.
When the ‘switch‘ instruction is executed, this table is searched
for the given value. If the value is found, control flow is transferred
to the corresponding destination; otherwise, control flow is transferred
to the default destination.

Depending on properties of the target machine and the particular
switch instruction, this instruction may be code generated in
different ways. For example, it could be generated as a series of
chained conditional branches or with a lookup table.

The ‘address‘ argument is the address of the label to jump to. The
rest of the arguments indicate the full set of possible destinations
that the address may point to. Blocks are allowed to occur multiple
times in the destination list, though this isn’t particularly useful.

This destination list is required so that dataflow analysis has an
accurate understanding of the CFG.

Control transfers to the block specified in the address argument. All
possible destination blocks must be listed in the label list, otherwise
this instruction has undefined behavior. This implies that jumps to
labels defined in other functions have undefined behavior as well.

The ‘invoke‘ instruction causes control to transfer to a specified
function, with the possibility of control flow transfer to either the
‘normal‘ label or the ‘exception‘ label. If the callee function
returns with the “ret” instruction, control flow will return to the
“normal” label. If the callee (or any indirect callees) returns via the
“resume” instruction or other exception handling
mechanism, control is interrupted and continued at the dynamically
nearest “exception” label.

The ‘exception‘ label is a landing
pad for the exception. As such,
‘exception‘ label is required to have the
“landingpad” instruction, which contains the
information about the behavior of the program after unwinding happens,
as its first non-PHI instruction. The restrictions on the
“landingpad” instruction’s tightly couples it to the “invoke”
instruction, so that the important information contained within the
“landingpad” instruction can’t be lost through normal code motion.

‘ptrtofunctionty‘: shall be the signature of the pointer to
function value being invoked. In most cases, this is a direct
function invocation, but indirect invoke‘s are just as possible,
branching off an arbitrary pointer to function value.

‘functionptrval‘: An LLVM value containing a pointer to a
function to be invoked.

‘functionargs‘: argument list whose types match the function
signature argument types and parameter attributes. All arguments must
be of first class type. If the function signature
indicates the function accepts a variable number of arguments, the
extra arguments can be specified.

‘normallabel‘: the label reached when the called function
executes a ‘ret‘ instruction.

‘exceptionlabel‘: the label reached when a callee returns via
the resume instruction or other exception handling
mechanism.

This instruction is designed to operate as a standard ‘call‘
instruction in most regards. The primary difference is that it
establishes an association with a label, which is used by the runtime
library to unwind the stack.

This instruction is used in languages with destructors to ensure that
proper cleanup is performed in the case of either a longjmp or a
thrown exception. Additionally, this is important for implementation of
‘catch‘ clauses in high-level languages that support them.

For the purposes of the SSA form, the definition of the value returned
by the ‘invoke‘ instruction is deemed to occur on the edge from the
current block to the “normal” label. If the callee unwinds then no
return value is available.

The ‘unreachable‘ instruction has no defined semantics. This
instruction is used to inform the optimizer that a particular portion of
the code is not reachable. This can be used to indicate that the code
after a no-return function cannot be reached, and other facts.

Binary operators are used to do most of the computation in a program.
They require two operands of the same type, execute an operation on
them, and produce a single value. The operands might represent multiple
data, as is the case with the vector data type. The
result value has the same type as its operands.

If the sum has unsigned overflow, the result returned is the
mathematical result modulo 2n, where n is the bit width of
the result.

Because LLVM integers use a two’s complement representation, this
instruction is appropriate for both signed and unsigned integers.

nuw and nsw stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw and/or nsw keywords are present, the
result value of the add is a poison value if
unsigned and/or signed overflow, respectively, occurs.

The value produced is the floating point sum of the two operands. This
instruction can also take any number of fast-math flags,
which are optimization hints to enable otherwise unsafe floating point
optimizations:

If the difference has unsigned overflow, the result returned is the
mathematical result modulo 2n, where n is the bit width of
the result.

Because LLVM integers use a two’s complement representation, this
instruction is appropriate for both signed and unsigned integers.

nuw and nsw stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw and/or nsw keywords are present, the
result value of the sub is a poison value if
unsigned and/or signed overflow, respectively, occurs.

The value produced is the floating point difference of the two operands.
This instruction can also take any number of fast-math
flags, which are optimization hints to enable otherwise
unsafe floating point optimizations:

If the result of the multiplication has unsigned overflow, the result
returned is the mathematical result modulo 2n, where n is the
bit width of the result.

Because LLVM integers use a two’s complement representation, and the
result is the same width as the operands, this instruction returns the
correct result for both signed and unsigned integers. If a full product
(e.g. i32 * i32 -> i64) is needed, the operands should be
sign-extended or zero-extended as appropriate to the width of the full
product.

nuw and nsw stand for “No Unsigned Wrap” and “No Signed Wrap”,
respectively. If the nuw and/or nsw keywords are present, the
result value of the mul is a poison value if
unsigned and/or signed overflow, respectively, occurs.

The value produced is the floating point product of the two operands.
This instruction can also take any number of fast-math
flags, which are optimization hints to enable otherwise
unsafe floating point optimizations:

The value produced is the floating point quotient of the two operands.
This instruction can also take any number of fast-math
flags, which are optimization hints to enable otherwise
unsafe floating point optimizations:

This instruction returns the remainder of a division (where the result
is either zero or has the same sign as the dividend, op1), not the
modulo operator (where the result is either zero or has the same sign
as the divisor, op2) of a value. For more information about the
difference, see The Math
Forum. For a
table of how this is implemented in various languages, please see
Wikipedia: modulo
operation.

Note that signed integer remainder and unsigned integer remainder are
distinct operations; for unsigned integer remainder, use ‘urem‘.

Taking the remainder of a division by zero leads to undefined behavior.
Overflow also leads to undefined behavior; this is a rare case, but can
occur, for example, by taking the remainder of a 32-bit division of
-2147483648 by -1. (The remainder doesn’t actually overflow, but this
rule lets srem be implemented using instructions that return both the
result of the division and the remainder.)

This instruction returns the remainder of a division. The remainder
has the same sign as the dividend. This instruction can also take any
number of fast-math flags, which are optimization hints
to enable otherwise unsafe floating point optimizations:

Bitwise binary operators are used to do various forms of bit-twiddling
in a program. They are generally very efficient instructions and can
commonly be strength reduced from other instructions. They require two
operands of the same type, execute an operation on them, and produce a
single value. The resulting value is the same type as its operands.

The value produced is op1 * 2op2 mod 2n,
where n is the width of the result. If op2 is (statically or
dynamically) equal to or larger than the number of bits in
op1, the result is undefined. If the arguments are vectors, each
vector element of op1 is shifted by the corresponding shift amount
in op2.

If the nuw keyword is present, then the shift produces a poison
value if it shifts out any non-zero bits. If the
nsw keyword is present, then the shift produces a poison
value if it shifts out any bits that disagree with the
resultant sign bit. As such, NUW/NSW have the same semantics as they
would if the shift were expressed as a mul instruction with the same
nsw/nuw bits in (mul %op1, (shl 1, %op2)).

This instruction always performs a logical shift right operation. The
most significant bits of the result will be filled with zero bits after
the shift. If op2 is (statically or dynamically) equal to or larger
than the number of bits in op1, the result is undefined. If the
arguments are vectors, each vector element of op1 is shifted by the
corresponding shift amount in op2.

If the exact keyword is present, the result value of the lshr is
a poison value if any of the bits shifted out are
non-zero.

This instruction always performs an arithmetic shift right operation,
The most significant bits of the result will be filled with the sign bit
of op1. If op2 is (statically or dynamically) equal to or larger
than the number of bits in op1, the result is undefined. If the
arguments are vectors, each vector element of op1 is shifted by the
corresponding shift amount in op2.

If the exact keyword is present, the result value of the ashr is
a poison value if any of the bits shifted out are
non-zero.

LLVM supports several instructions to represent vector operations in a
target-independent manner. These instructions cover the element-access
and vector-specific operations needed to process vectors effectively.
While LLVM does directly support these vector operations, many
sophisticated algorithms will want to use target-specific intrinsics to
take full advantage of a specific target.

The first operand of an ‘extractelement‘ instruction is a value of
vector type. The second operand is an index indicating
the position from which to extract the element. The index may be a
variable of any integer type.

The first operand of an ‘insertelement‘ instruction is a value of
vector type. The second operand is a scalar value whose
type must equal the element type of the first operand. The third operand
is an index indicating the position at which to insert the value. The
index may be a variable of any integer type.

The first two operands of a ‘shufflevector‘ instruction are vectors
with the same type. The third argument is a shuffle mask whose element
type is always ‘i32’. The result of the instruction is a vector whose
length is the same as the shuffle mask and whose element type is the
same as the element type of the first two operands.

The shuffle mask operand is required to be a constant vector with either
constant integer or undef values.

The elements of the two input vectors are numbered from left to right
across both of the vectors. The shuffle mask operand specifies, for each
element of the result vector, which element of the two input vectors the
result element gets. The element selector may be undef (meaning “don’t
care”) and the second operand may be undef if performing a shuffle from
only one vector.

The first operand of an ‘extractvalue‘ instruction is a value of
struct or array type. The operands are
constant indices to specify which value to extract in a similar manner
as indices in a ‘getelementptr‘ instruction.

The major differences to getelementptr indexing are:

Since the value being indexed is not a pointer, the first index is
omitted and assumed to be zero.

The first operand of an ‘insertvalue‘ instruction is a value of
struct or array type. The second operand is
a first-class value to insert. The following operands are constant
indices indicating the position at which to insert the value in a
similar manner as indices in a ‘extractvalue‘ instruction. The value
to insert must have the same type as the value identified by the
indices.

A key design point of an SSA-based representation is how it represents
memory. In LLVM, no memory locations are in SSA form, which makes things
very simple. This section describes how to read, write, and allocate
memory in LLVM.

The ‘alloca‘ instruction allocates memory on the stack frame of the
currently executing function, to be automatically released when this
function returns to its caller. The object is always allocated in the
generic address space (address space zero).

The ‘alloca‘ instruction allocates sizeof(<type>)*NumElements
bytes of memory on the runtime stack, returning a pointer of the
appropriate type to the program. If “NumElements” is specified, it is
the number of elements allocated, otherwise “NumElements” is defaulted
to be one. If a constant alignment is specified, the value result of the
allocation is guaranteed to be aligned to at least that boundary. The
alignment may not be greater than 1<<29. If not specified, or if
zero, the target can choose to align the allocation on any convenient
boundary compatible with the type.

Memory is allocated; a pointer is returned. The operation is undefined
if there is insufficient stack space for the allocation. ‘alloca‘d
memory is automatically released when the function returns. The
‘alloca‘ instruction is commonly used to represent automatic
variables that must have an address available. When the function returns
(either with the ret or resume instructions), the memory is
reclaimed. Allocating zero bytes is legal, but the result is undefined.
The order in which memory is allocated (ie., which way the stack grows)
is not specified.

The argument to the load instruction specifies the memory address
from which to load. The type specified must be a first
class type. If the load is marked as volatile,
then the optimizer is not allowed to modify the number or order of
execution of this load with other volatile
operations.

If the load is marked as atomic, it takes an extra
ordering and optional singlethread argument. The
release and acq_rel orderings are not valid on load
instructions. Atomic loads produce defined results
when they may see multiple atomic stores. The type of the pointee must
be an integer type whose bit width is a power of two greater than or
equal to eight and less than or equal to a target-specific size limit.
align must be explicitly specified on atomic loads, and the load has
undefined behavior if the alignment is not set to a value which is at
least the size in bytes of the pointee. !nontemporal does not have
any defined semantics for atomic loads.

The optional constant align argument specifies the alignment of the
operation (that is, the alignment of the memory address). A value of 0
or an omitted align argument means that the operation has the ABI
alignment for the target. It is the responsibility of the code emitter
to ensure that the alignment information is correct. Overestimating the
alignment results in undefined behavior. Underestimating the alignment
may produce less efficient code. An alignment of 1 is always safe. The
maximum possible alignment is 1<<29.

The optional !nontemporal metadata must reference a single
metadata name <index> corresponding to a metadata node with one
i32 entry of value 1. The existence of the !nontemporal
metadata on the instruction tells the optimizer and code generator
that this load is not expected to be reused in the cache. The code
generator may select special instructions to save cache bandwidth, such
as the MOVNT instruction on x86.

The optional !invariant.load metadata must reference a single
metadata name <index> corresponding to a metadata node with no
entries. The existence of the !invariant.load metadata on the
instruction tells the optimizer and code generator that the address
operand to this load points to memory which can be assumed unchanged.
Being invariant does not imply that a location is dereferenceable,
but it does imply that once the location is known dereferenceable
its value is henceforth unchanging.

The optional !nonnull metadata must reference a single
metadata name <index> corresponding to a metadata node with no
entries. The existence of the !nonnull metadata on the
instruction tells the optimizer that the value loaded is known to
never be null. This is analogous to the ‘’nonnull’’ attribute
on parameters and return values. This metadata can only be applied
to loads of a pointer type.

The optional !dereferenceable metadata must reference a single
metadata name <index> corresponding to a metadata node with one i64
entry. The existence of the !dereferenceable metadata on the instruction
tells the optimizer that the value loaded is known to be dereferenceable.
The number of bytes known to be dereferenceable is specified by the integer
value in the metadata node. This is analogous to the ‘’dereferenceable’’
attribute on parameters and return values. This metadata can only be applied
to loads of a pointer type.

The optional !dereferenceable_or_null metadata must reference a single
metadata name <index> corresponding to a metadata node with one i64
entry. The existence of the !dereferenceable_or_null metadata on the
instruction tells the optimizer that the value loaded is known to be either
dereferenceable or null.
The number of bytes known to be dereferenceable is specified by the integer
value in the metadata node. This is analogous to the ‘’dereferenceable_or_null’’
attribute on parameters and return values. This metadata can only be applied
to loads of a pointer type.

The location of memory pointed to is loaded. If the value being loaded
is of scalar type then the number of bytes read does not exceed the
minimum number of bytes needed to hold all bits of the type. For
example, loading an i24 reads at most three bytes. When loading a
value of a type like i20 with a size that is not an integral number
of bytes, the result is undefined if the value was not originally
written using a store of the same type.

There are two arguments to the store instruction: a value to store
and an address at which to store it. The type of the <pointer>
operand must be a pointer to the first class type of
the <value> operand. If the store is marked as volatile,
then the optimizer is not allowed to modify the number or order of
execution of this store with other volatile
operations.

If the store is marked as atomic, it takes an extra
ordering and optional singlethread argument. The
acquire and acq_rel orderings aren’t valid on store
instructions. Atomic loads produce defined results
when they may see multiple atomic stores. The type of the pointee must
be an integer type whose bit width is a power of two greater than or
equal to eight and less than or equal to a target-specific size limit.
align must be explicitly specified on atomic stores, and the store
has undefined behavior if the alignment is not set to a value which is
at least the size in bytes of the pointee. !nontemporal does not
have any defined semantics for atomic stores.

The optional constant align argument specifies the alignment of the
operation (that is, the alignment of the memory address). A value of 0
or an omitted align argument means that the operation has the ABI
alignment for the target. It is the responsibility of the code emitter
to ensure that the alignment information is correct. Overestimating the
alignment results in undefined behavior. Underestimating the
alignment may produce less efficient code. An alignment of 1 is always
safe. The maximum possible alignment is 1<<29.

The optional !nontemporal metadata must reference a single metadata
name <index> corresponding to a metadata node with one i32 entry of
value 1. The existence of the !nontemporal metadata on the instruction
tells the optimizer and code generator that this load is not expected to
be reused in the cache. The code generator may select special
instructions to save cache bandwidth, such as the MOVNT instruction on
x86.

The contents of memory are updated to contain <value> at the
location specified by the <pointer> operand. If <value> is
of scalar type then the number of bytes written does not exceed the
minimum number of bytes needed to hold all bits of the type. For
example, storing an i24 writes at most three bytes. When writing a
value of a type like i20 with a size that is not an integral number
of bytes, it is unspecified what happens to the extra bits that do not
belong to the type, but they will typically be overwritten.

A fence A which has (at least) release ordering semantics
synchronizes with a fence B with (at least) acquire ordering
semantics if and only if there exist atomic operations X and Y, both
operating on some atomic object M, such that A is sequenced before X, X
modifies M (either directly or through some side effect of a sequence
headed by X), Y is sequenced before B, and Y observes M. This provides a
happens-before dependency between A and B. Rather than an explicit
fence, one (but not both) of the atomic operations X or Y might
provide a release or acquire (resp.) ordering constraint and
still synchronize-with the explicit fence and establish the
happens-before edge.

A fence which has seq_cst ordering, in addition to having both
acquire and release semantics specified above, participates in
the global program order of other seq_cst operations and/or fences.

The optional “singlethread” argument specifies
that the fence only synchronizes with other fences in the same thread.
(This is useful for interacting with signal handlers.)

There are three arguments to the ‘cmpxchg‘ instruction: an address
to operate on, a value to compare to the value currently be at that
address, and a new value to place at that address if the compared values
are equal. The type of ‘<cmp>’ must be an integer type whose bit width
is a power of two greater than or equal to eight and less than or equal
to a target-specific size limit. ‘<cmp>’ and ‘<new>’ must have the same
type, and the type of ‘<pointer>’ must be a pointer to that type. If the
cmpxchg is marked as volatile, then the optimizer is not allowed
to modify the number or order of execution of this cmpxchg with
other volatile operations.

The success and failure ordering arguments specify how this
cmpxchg synchronizes with other atomic operations. Both ordering parameters
must be at least monotonic, the ordering constraint on failure must be no
stronger than that on success, and the failure ordering cannot be either
release or acq_rel.

The optional “singlethread” argument declares that the cmpxchg
is only atomic with respect to code (usually signal handlers) running in
the same thread as the cmpxchg. Otherwise the cmpxchg is atomic with
respect to all other code in the system.

The pointer passed into cmpxchg must have alignment greater than or
equal to the size in memory of the operand.

The contents of memory at the location specified by the ‘<pointer>‘ operand
is read and compared to ‘<cmp>‘; if the read value is the equal, the
‘<new>‘ is written. The original value at the location is returned, together
with a flag indicating success (true) or failure (false).

If the cmpxchg operation is marked as weak then a spurious failure is
permitted: the operation may not write <new> even if the comparison
matched.

If the cmpxchg operation is strong (the default), the i1 value is 1 if and only
if the value loaded equals cmp.

A successful cmpxchg is a read-modify-write instruction for the purpose of
identifying release sequences. A failed cmpxchg is equivalent to an atomic
load with an ordering parameter determined the second ordering parameter.

There are three arguments to the ‘atomicrmw‘ instruction: an
operation to apply, an address whose value to modify, an argument to the
operation. The operation must be one of the following keywords:

xchg

add

sub

and

nand

or

xor

max

min

umax

umin

The type of ‘<value>’ must be an integer type whose bit width is a power
of two greater than or equal to eight and less than or equal to a
target-specific size limit. The type of the ‘<pointer>‘ operand must
be a pointer to that type. If the atomicrmw is marked as
volatile, then the optimizer is not allowed to modify the number or
order of execution of this atomicrmw with other volatile
operations.

The contents of memory at the location specified by the ‘<pointer>‘
operand are atomically read, modified, and written back. The original
value at the location is returned. The modification is specified by the
operation argument:

The ‘getelementptr‘ instruction is used to get the address of a
subelement of an aggregate data structure. It performs
address calculation only and does not access memory. The instruction can also
be used to calculate a vector of such addresses.

The first argument is always a type used as the basis for the calculations.
The second argument is always a pointer or a vector of pointers, and is the
base address to start from. The remaining arguments are indices
that indicate which of the elements of the aggregate object are indexed.
The interpretation of each index is dependent on the type being indexed
into. The first index always indexes the pointer value given as the
first argument, the second index indexes a value of the type pointed to
(not necessarily the value directly pointed to, since the first index
can be non-zero), etc. The first type indexed into must be a pointer
value, subsequent types can be arrays, vectors, and structs. Note that
subsequent types being indexed into can never be pointers, since that
would require loading the pointer before continuing calculation.

The type of each index argument depends on the type it is indexing into.
When indexing into a (optionally packed) structure, only i32 integer
constants are allowed (when using a vector of indices they must all
be the samei32 integer constant). When indexing into an array,
pointer or vector, integers of any width are allowed, and they are not
required to be constant. These integers are treated as signed values
where relevant.

For example, let’s consider a C code fragment and how it gets compiled
to LLVM:

In the example above, the first index is indexing into the
‘%struct.ST*‘ type, which is a pointer, yielding a ‘%struct.ST‘
= ‘{i32,double,%struct.RT}‘ type, a structure. The second index
indexes into the third element of the structure, yielding a
‘%struct.RT‘ = ‘{i8,[10x[20xi32]],i8}‘ type, another
structure. The third index indexes into the second element of the
structure, yielding a ‘[10x[20xi32]]‘ type, an array. The two
dimensions of the array are subscripted into, yielding an ‘i32‘
type. The ‘getelementptr‘ instruction returns a pointer to this
element, thus computing a value of ‘i32*‘ type.

Note that it is perfectly legal to index partially through a structure,
returning a pointer to an inner element. Because of this, the LLVM code
for the given testcase is equivalent to:

If the inbounds keyword is present, the result value of the
getelementptr is a poison value if the base
pointer is not an in bounds address of an allocated object, or if any
of the addresses that would be formed by successive addition of the
offsets implied by the indices to the base address with infinitely
precise signed arithmetic are not an in bounds address of that
allocated object. The in bounds addresses for an allocated object are
all the addresses that point into the object, plus the address one byte
past the end. In cases where the base is a vector of pointers the
inbounds keyword applies to each of the computations element-wise.

If the inbounds keyword is not present, the offsets are added to the
base address with silently-wrapping two’s complement arithmetic. If the
offsets have a different width from the pointer, they are sign-extended
or truncated to the width of the pointer. The result value of the
getelementptr may be outside the object pointed to by the base
pointer. The result value may not necessarily be used to access memory
though, even if it happens to point into allocated storage. See the
Pointer Aliasing Rules section for more
information.

The getelementptr instruction is often confusing. For some more insight
into how it works, see the getelementptr FAQ.

The getelementptr returns a vector of pointers, instead of a single address,
when one or more of its arguments is a vector. In such cases, all vector
arguments should have the same number of elements, and every scalar argument
will be effectively broadcast into a vector during address calculation.

; All arguments are vectors:; A[i] = ptrs[i] + offsets[i]*sizeof(i8)%A=getelementptri8,<4xi8*>%ptrs,<4xi64>%offsets; Add the same scalar offset to each pointer of a vector:; A[i] = ptrs[i] + offset*sizeof(i8)%A=getelementptri8,<4xi8*>%ptrs,i64%offset; Add distinct offsets to the same pointer:; A[i] = ptr + offsets[i]*sizeof(i8)%A=getelementptri8,i8*%ptr,<4xi64>%offsets; In all cases described above the type of the result is <4 x i8*>

The ‘trunc‘ instruction takes a value to trunc, and a type to trunc
it to. Both types must be of integer types, or vectors
of the same number of integers. The bit size of the value must be
larger than the bit size of the destination type, ty2. Equal sized
types are not allowed.

The ‘trunc‘ instruction truncates the high order bits in value
and converts the remaining bits to ty2. Since the source size must
be larger than the destination size, trunc cannot be a no-op cast.
It will always truncate bits.

The ‘zext‘ instruction takes a value to cast, and a type to cast it
to. Both types must be of integer types, or vectors of
the same number of integers. The bit size of the value must be
smaller than the bit size of the destination type, ty2.

The ‘sext‘ instruction takes a value to cast, and a type to cast it
to. Both types must be of integer types, or vectors of
the same number of integers. The bit size of the value must be
smaller than the bit size of the destination type, ty2.

The ‘fptrunc‘ instruction takes a floating point
value to cast and a floating point type to cast it to.
The size of value must be larger than the size of ty2. This
implies that fptrunc cannot be used to make a no-op cast.

The ‘fptrunc‘ instruction truncates a value from a larger
floating point type to a smaller floating
point type. If the value cannot fit within the
destination type, ty2, then the results are undefined.

The ‘fpext‘ instruction extends the value from a smaller
floating point type to a larger floating
point type. The fpext cannot be used to make a
no-op cast because it always changes bits. Use bitcast to make a
no-op cast for a floating point cast.

The ‘fptoui‘ instruction takes a value to cast, which must be a
scalar or vector floating point value, and a type to
cast it to ty2, which must be an integer type. If
ty is a vector floating point type, ty2 must be a vector integer
type with the same number of elements as ty

The ‘fptosi‘ instruction takes a value to cast, which must be a
scalar or vector floating point value, and a type to
cast it to ty2, which must be an integer type. If
ty is a vector floating point type, ty2 must be a vector integer
type with the same number of elements as ty

The ‘uitofp‘ instruction takes a value to cast, which must be a
scalar or vector integer value, and a type to cast it to
ty2, which must be an floating point type. If
ty is a vector integer type, ty2 must be a vector floating point
type with the same number of elements as ty

The ‘uitofp‘ instruction interprets its operand as an unsigned
integer quantity and converts it to the corresponding floating point
value. If the value cannot fit in the floating point value, the results
are undefined.

The ‘sitofp‘ instruction takes a value to cast, which must be a
scalar or vector integer value, and a type to cast it to
ty2, which must be an floating point type. If
ty is a vector integer type, ty2 must be a vector floating point
type with the same number of elements as ty

The ‘sitofp‘ instruction interprets its operand as a signed integer
quantity and converts it to the corresponding floating point value. If
the value cannot fit in the floating point value, the results are
undefined.

The ‘ptrtoint‘ instruction converts value to integer type
ty2 by interpreting the pointer value as an integer and either
truncating or zero extending that value to the size of the integer type.
If value is smaller than ty2 then a zero extension is done. If
value is larger than ty2 then a truncation is done. If they are
the same size, then nothing is done (no-op cast) other than a type
change.

The ‘inttoptr‘ instruction converts value to type ty2 by
applying either a zero extension or a truncation depending on the size
of the integer value. If value is larger than the size of a
pointer then a truncation is done. If value is smaller than the size
of a pointer then a zero extension is done. If they are the same size,
nothing is done (no-op cast).

The ‘bitcast‘ instruction takes a value to cast, which must be a
non-aggregate first class value, and a type to cast it to, which must
also be a non-aggregate first class type. The
bit sizes of value and the destination type, ty2, must be
identical. If the source type is a pointer, the destination type must
also be a pointer of the same size. This instruction supports bitwise
conversion of vectors to integers and to vectors of other types (as
long as they have the same size).

The ‘bitcast‘ instruction converts value to type ty2. It
is always a no-op cast because no bits change with this
conversion. The conversion is done as if the value had been stored
to memory and read back as type ty2. Pointer (or vector of
pointers) types may only be converted to other pointer (or vector of
pointers) types with the same address space through this instruction.
To convert pointers to other types, use the inttoptr
or ptrtoint instructions first.

The ‘addrspacecast‘ instruction converts the pointer value
ptrval to type pty2. It can be a no-op cast or a complex
value modification, depending on the target and the address space
pair. Pointer conversions within the same address space must be
performed with the bitcast instruction. Note that if the address space
conversion is legal then both result and operand refer to the same memory
location.

The ‘icmp‘ compares op1 and op2 according to the condition
code given as cond. The comparison performed always yields either an
i1 or vector of i1 result, as follows:

eq: yields true if the operands are equal, false
otherwise. No sign interpretation is necessary or performed.

ne: yields true if the operands are unequal, false
otherwise. No sign interpretation is necessary or performed.

ugt: interprets the operands as unsigned values and yields
true if op1 is greater than op2.

uge: interprets the operands as unsigned values and yields
true if op1 is greater than or equal to op2.

ult: interprets the operands as unsigned values and yields
true if op1 is less than op2.

ule: interprets the operands as unsigned values and yields
true if op1 is less than or equal to op2.

sgt: interprets the operands as signed values and yields true
if op1 is greater than op2.

sge: interprets the operands as signed values and yields true
if op1 is greater than or equal to op2.

slt: interprets the operands as signed values and yields true
if op1 is less than op2.

sle: interprets the operands as signed values and yields true
if op1 is less than or equal to op2.

If the operands are pointer typed, the pointer values
are compared as if they were integers.

If the operands are integer vectors, then they are compared element by
element. The result is an i1 vector with the same number of elements
as the values being compared. Otherwise, the result is an i1.

The ‘fcmp‘ instruction compares op1 and op2 according to the
condition code given as cond. If the operands are vectors, then the
vectors are compared element by element. Each comparison performed
always yields an i1 result, as follows:

false: always yields false, regardless of operands.

oeq: yields true if both operands are not a QNAN and op1
is equal to op2.

ogt: yields true if both operands are not a QNAN and op1
is greater than op2.

oge: yields true if both operands are not a QNAN and op1
is greater than or equal to op2.

olt: yields true if both operands are not a QNAN and op1
is less than op2.

ole: yields true if both operands are not a QNAN and op1
is less than or equal to op2.

one: yields true if both operands are not a QNAN and op1
is not equal to op2.

ord: yields true if both operands are not a QNAN.

ueq: yields true if either operand is a QNAN or op1 is
equal to op2.

ugt: yields true if either operand is a QNAN or op1 is
greater than op2.

uge: yields true if either operand is a QNAN or op1 is
greater than or equal to op2.

ult: yields true if either operand is a QNAN or op1 is
less than op2.

ule: yields true if either operand is a QNAN or op1 is
less than or equal to op2.

une: yields true if either operand is a QNAN or op1 is
not equal to op2.

uno: yields true if either operand is a QNAN.

true: always yields true, regardless of operands.

The fcmp instruction can also optionally take any number of
fast-math flags, which are optimization hints to enable
otherwise unsafe floating point optimizations.

Any set of fast-math flags are legal on an fcmp instruction, but the
only flags that have any effect on its semantics are those that allow
assumptions to be made about the values of input arguments; namely
nnan, ninf, and nsz. See Fast-Math Flags for more information.

The type of the incoming values is specified with the first type field.
After this, the ‘phi‘ instruction takes a list of pairs as
arguments, with one pair for each predecessor basic block of the current
block. Only values of first class type may be used as
the value arguments to the PHI node. Only labels may be used as the
label arguments.

There must be no non-phi instructions between the start of a basic block
and the PHI instructions: i.e. PHI instructions must be first in a basic
block.

For the purposes of the SSA form, the use of each incoming value is
deemed to occur on the edge from the corresponding predecessor block to
the current block (but after any definition of an ‘invoke‘
instruction’s return value on the same edge).

The optional tail and musttail markers indicate that the optimizers
should perform tail call optimization. The tail marker is a hint that
can be ignored. The musttail marker
means that the call must be tail call optimized in order for the program to
be correct. The musttail marker provides these guarantees:

The call will not cause unbounded stack growth if it is part of a
recursive cycle in the call graph.

The optional “cconv” marker indicates which calling
convention the call should use. If none is
specified, the call defaults to using C calling conventions. The
calling convention of the call must match the calling convention of
the target function, or else the behavior is undefined.

‘ty‘: the type of the call instruction itself which is also the
type of the return value. Functions that return no value are marked
void.

‘fnty‘: shall be the signature of the pointer to function value
being invoked. The argument types must match the types implied by
this signature. This type can be omitted if the function is not
varargs and if the function type does not return a pointer to a
function.

‘fnptrval‘: An LLVM value containing a pointer to a function to
be invoked. In most cases, this is a direct function invocation, but
indirect call‘s are just as possible, calling an arbitrary pointer
to function value.

‘functionargs‘: argument list whose types match the function
signature argument types and parameter attributes. All arguments must
be of first class type. If the function signature
indicates the function accepts a variable number of arguments, the
extra arguments can be specified.

The ‘call‘ instruction is used to cause control flow to transfer to
a specified function, with its incoming arguments bound to the specified
values. Upon a ‘ret‘ instruction in the called function, control
flow continues with the instruction after the function call, and the
return value of the function is bound to the result argument.

llvm treats calls to some functions with names and arguments that match
the standard C99 library as being the C99 library functions, and may
perform optimizations or generate code for them under that assumption.
This is something we’d like to change in the future to provide better
support for freestanding environments and non-C-based languages.

This instruction takes a va_list* value and the type of the
argument. It returns a value of the specified argument type and
increments the va_list to point to the next argument. The actual
type of va_list is target specific.

The ‘va_arg‘ instruction loads an argument of the specified type
from the specified va_list and causes the va_list to point to
the next argument. For more information, see the variable argument
handling Intrinsic Functions.

It is legal for this instruction to be called in a function which does
not take a variable number of arguments, for example, the vfprintf
function.

va_arg is an LLVM instruction instead of an intrinsic
function because it takes a type as an argument.

The ‘landingpad‘ instruction is used by LLVM’s exception handling
system to specify that a basic block
is a landing pad — one where the exception lands, and corresponds to the
code found in the catch portion of a try/catch sequence. It
defines values supplied by the personality function upon
re-entry to the function. The resultval has the type resultty.

The optional
cleanup flag indicates that the landing pad block is a cleanup.

A clause begins with the clause type — catch or filter — and
contains the global variable representing the “type” that may be caught
or filtered respectively. Unlike the catch clause, the filter
clause takes an array constant as its argument. Use
“[0xi8**]undef” for a filter which cannot throw. The
‘landingpad‘ instruction must contain at least one clause or
the cleanup flag.

The ‘landingpad‘ instruction defines the values which are set by the
personality function upon re-entry to the function, and
therefore the “result type” of the landingpad instruction. As with
calling conventions, how the personality function results are
represented in LLVM IR is target specific.

The clauses are applied in order from top to bottom. If two
landingpad instructions are merged together through inlining, the
clauses from the calling function are appended to the list of clauses.
When the call stack is being unwound due to an exception being thrown,
the exception is compared against each clause in turn. If it doesn’t
match any of the clauses, and the cleanup flag is not set, then
unwinding continues further up the call stack.

The landingpad instruction has several restrictions:

A landing pad block is a basic block which is the unwind destination
of an ‘invoke‘ instruction.

A landing pad block must have a ‘landingpad‘ instruction as its
first non-PHI instruction.

There can be only one ‘landingpad‘ instruction within the landing
pad block.

A basic block that is not a landing pad block may not include a
‘landingpad‘ instruction.

LLVM supports the notion of an “intrinsic function”. These functions
have well known names and semantics and are required to follow certain
restrictions. Overall, these intrinsics represent an extension mechanism
for the LLVM language that does not require changing all of the
transformations in LLVM when adding to the language (or the bitcode
reader/writer, the parser, etc...).

Intrinsic function names must all start with an “llvm.” prefix. This
prefix is reserved in LLVM for intrinsic names; thus, function names may
not begin with this prefix. Intrinsic functions must always be external
functions: you cannot define the body of intrinsic functions. Intrinsic
functions may only be used in call or invoke instructions: it is illegal
to take the address of an intrinsic function. Additionally, because
intrinsic functions are part of the LLVM language, it is required if any
are added that they be documented here.

Some intrinsic functions can be overloaded, i.e., the intrinsic
represents a family of functions that perform the same operation but on
different data types. Because LLVM can represent over 8 million
different integer types, overloading is used commonly to allow an
intrinsic function to operate on any integer type. One or more of the
argument types or the result type can be overloaded to accept any
integer type. Argument types may also be defined as exactly matching a
previous argument’s type or the result type. This allows an intrinsic
function which accepts multiple arguments, but needs all of them to be
of the same type, to only be overloaded with respect to a single
argument or the result.

Overloaded intrinsics will have the names of its overloaded argument
types encoded into its function name, each preceded by a period. Only
those types which are overloaded result in a name suffix. Arguments
whose type is matched against another type do not. For example, the
llvm.ctpop function can take an integer of any width and returns an
integer of exactly the same integer width. This leads to a family of
functions such as i8@llvm.ctpop.i8(i8%val) and
i29@llvm.ctpop.i29(i29%val). Only one type, the return type, is
overloaded, and only one type suffix is required. Because the argument’s
type is matched against the return type, it does not require its own
name suffix.

Variable argument support is defined in LLVM with the
va_arg instruction and these three intrinsic
functions. These functions are related to the similarly named macros
defined in the <stdarg.h> header file.

All of these functions operate on arguments that use a target-specific
value type “va_list”. The LLVM assembly language reference manual
does not define what this type is, so all transformations should be
prepared to handle these functions regardless of the type used.

This example shows how the va_arg instruction and the
variable argument handling intrinsic functions are used.

; This struct is different for every platform. For most platforms,; it is merely an i8*.%struct.va_list=type{i8*}; For Unix x86_64 platforms, va_list is the following struct:; %struct.va_list = type { i32, i32, i8*, i8* }definei32@test(i32%X,...){; Initialize variable argument processing%ap=alloca%struct.va_list%ap2=bitcast%struct.va_list*%aptoi8*callvoid@llvm.va_start(i8*%ap2); Read a single integer argument%tmp=va_argi8*%ap2,i32; Demonstrate usage of llvm.va_copy and llvm.va_end%aq=allocai8*%aq2=bitcasti8**%aqtoi8*callvoid@llvm.va_copy(i8*%aq2,i8*%ap2)callvoid@llvm.va_end(i8*%aq2); Stop processing of arguments.callvoid@llvm.va_end(i8*%ap2)reti32%tmp}declarevoid@llvm.va_start(i8*)declarevoid@llvm.va_copy(i8*,i8*)declarevoid@llvm.va_end(i8*)

The ‘llvm.va_start‘ intrinsic works just like the va_start macro
available in C. In a target-dependent way, it initializes the
va_list element to which the argument points, so that the next call
to va_arg will produce the first variable argument passed to the
function. Unlike the C va_start macro, this intrinsic does not need
to know the last argument of the function as the compiler can figure
that out.

The ‘llvm.va_end‘ intrinsic works just like the va_end macro
available in C. In a target-dependent way, it destroys the va_list
element to which the argument points. Calls to
llvm.va_start and
llvm.va_copy must be matched exactly with calls to
llvm.va_end.

The ‘llvm.va_copy‘ intrinsic works just like the va_copy macro
available in C. In a target-dependent way, it copies the source
va_list element into the destination va_list element. This
intrinsic is necessary because the `` llvm.va_start`` intrinsic may be
arbitrarily complex and require, for example, memory allocation.

LLVM’s support for Accurate Garbage Collection
(GC) requires the frontend to generate code containing appropriate intrinsic
calls and select an appropriate GC strategy which knows how to lower these
intrinsics in a manner which is appropriate for the target collector.

These intrinsics allow identification of GC roots on the
stack, as well as garbage collector implementations that
require read and write barriers.
Frontends for type-safe garbage collected languages should generate
these intrinsics to make use of the LLVM garbage collectors. For more
details, see Garbage Collection with LLVM.

LLVM provides an second experimental set of intrinsics for describing garbage
collection safepoints in compiled code. These intrinsics are an alternative
to the llvm.gcroot intrinsics, but are compatible with the ones for
read and write barriers. The
differences in approach are covered in the Garbage Collection with LLVM documentation. The intrinsics themselves are
described in Garbage Collection Safepoints in LLVM.

The first argument specifies the address of a stack object that contains
the root pointer. The second pointer (which must be either a constant or
a global value address) contains the meta-data to be associated with the
root.

At runtime, a call to this intrinsic stores a null pointer into the
“ptrloc” location. At compile-time, the code generator generates
information to allow the runtime to find the pointer at GC safe points.
The ‘llvm.gcroot‘ intrinsic may only be used in a function which
specifies a GC algorithm.

The second argument is the address to read from, which should be an
address allocated from the garbage collector. The first object is a
pointer to the start of the referenced object, if needed by the language
runtime (otherwise null).

The ‘llvm.gcread‘ intrinsic has the same semantics as a load
instruction, but may be replaced with substantially more complex code by
the garbage collector runtime, as needed. The ‘llvm.gcread‘
intrinsic may only be used in a function which specifies a GC
algorithm.

The first argument is the reference to store, the second is the start of
the object to store it to, and the third is the address of the field of
Obj to store to. If the runtime does not require a pointer to the
object, Obj may be null.

The ‘llvm.gcwrite‘ intrinsic has the same semantics as a store
instruction, but may be replaced with substantially more complex code by
the garbage collector runtime, as needed. The ‘llvm.gcwrite‘
intrinsic may only be used in a function which specifies a GC
algorithm.

The argument to this intrinsic indicates which function to return the
address for. Zero indicates the calling function, one indicates its
caller, etc. The argument is required to be a constant integer
value.

The ‘llvm.returnaddress‘ intrinsic either returns a pointer
indicating the return address of the specified call frame, or zero if it
cannot be identified. The value returned by this intrinsic is likely to
be incorrect or 0 for arguments other than zero, so it should only be
used for debugging purposes.

Note that calling this intrinsic does not prevent function inlining or
other aggressive transformations, so the value returned may not be that
of the obvious source-language caller.

The argument to this intrinsic indicates which function to return the
frame pointer for. Zero indicates the calling function, one indicates
its caller, etc. The argument is required to be a constant integer
value.

The ‘llvm.frameaddress‘ intrinsic either returns a pointer
indicating the frame address of the specified call frame, or zero if it
cannot be identified. The value returned by this intrinsic is likely to
be incorrect or 0 for arguments other than zero, so it should only be
used for debugging purposes.

Note that calling this intrinsic does not prevent function inlining or
other aggressive transformations, so the value returned may not be that
of the obvious source-language caller.

The ‘llvm.localescape‘ intrinsic escapes offsets of a collection of static
allocas, and the ‘llvm.localrecover‘ intrinsic applies those offsets to a
live frame pointer to recover the address of the allocation. The offset is
computed during frame layout of the caller of llvm.localescape.

All arguments to ‘llvm.localescape‘ must be pointers to static allocas or
casts of static allocas. Each function can only call ‘llvm.localescape‘
once, and it can only do so from the entry block.

The func argument to ‘llvm.localrecover‘ must be a constant
bitcasted pointer to a function defined in the current module. The code
generator cannot determine the frame allocation offset of functions defined in
other modules.

The fp argument to ‘llvm.localrecover‘ must be a frame pointer of a
call frame that is currently live. The return value of ‘llvm.localaddress‘
is one way to produce such a value, but various runtimes also expose a suitable
pointer in platform-specific ways.

The idx argument to ‘llvm.localrecover‘ indicates which alloca passed to
‘llvm.localescape‘ to recover. It is zero-indexed.

These intrinsics allow a group of functions to share access to a set of local
stack allocations of a one parent function. The parent function may call the
‘llvm.localescape‘ intrinsic once from the function entry block, and the
child functions can use ‘llvm.localrecover‘ to access the escaped allocas.
The ‘llvm.localescape‘ intrinsic blocks inlining, as inlining changes where
the escaped allocas are allocated, which would break attempts to use
‘llvm.localrecover‘.

The ‘llvm.read_register‘ and ‘llvm.write_register‘ intrinsics
provides access to the named register. The register must be valid on
the architecture being compiled to. The type needs to be compatible
with the register being read.

The ‘llvm.read_register‘ intrinsic returns the current value of the
register, where possible. The ‘llvm.write_register‘ intrinsic sets
the current value of the register, where possible.

This is useful to implement named register global variables that need
to always be mapped to a specific register, as is common practice on
bare-metal programs including OS kernels.

The compiler doesn’t check for register availability or use of the used
register in surrounding code, including inline assembly. Because of that,
allocatable registers are not supported.

Warning: So far it only works with the stack pointer on selected
architectures (ARM, AArch64, PowerPC and x86_64). Significant amount of
work is needed to support other registers and even more so, allocatable
registers.

The ‘llvm.stacksave‘ intrinsic is used to remember the current state
of the function stack, for use with
llvm.stackrestore. This is useful for
implementing language features like scoped automatic variable sized
arrays in C99.

This intrinsic returns a opaque pointer value that can be passed to
llvm.stackrestore. When an
llvm.stackrestore intrinsic is executed with a value saved from
llvm.stacksave, it effectively restores the state of the stack to
the state it was in when the llvm.stacksave intrinsic executed. In
practice, this pops any alloca blocks from the stack that
were allocated after the llvm.stacksave was executed.

The ‘llvm.stackrestore‘ intrinsic is used to restore the state of
the function stack to the state it was in when the corresponding
llvm.stacksave intrinsic executed. This is
useful for implementing language features like scoped automatic variable
sized arrays in C99.

The ‘llvm.prefetch‘ intrinsic is a hint to the code generator to
insert a prefetch instruction if supported; otherwise, it is a noop.
Prefetches have no effect on the behavior of the program but can change
its performance characteristics.

address is the address to be prefetched, rw is the specifier
determining if the fetch should be for a read (0) or write (1), and
locality is a temporal locality specifier ranging from (0) - no
locality, to (3) - extremely local keep in cache. The cachetype
specifies whether the prefetch is performed on the data (1) or
instruction (0) cache. The rw, locality and cachetype
arguments must be constant integers.

This intrinsic does not modify the behavior of the program. In
particular, prefetches cannot trap and do not produce a value. On
targets that support this intrinsic, the prefetch can provide hints to
the processor cache for better performance.

The ‘llvm.pcmarker‘ intrinsic is a method to export a Program
Counter (PC) in a region of code to simulators and other tools. The
method is target specific, but it is expected that the marker will use
exported symbols to transmit the PC of the marker. The marker makes no
guarantees that it will remain with any specific instruction after
optimizations. It is possible that the presence of a marker will inhibit
optimizations. The intended use is to be inserted after optimizations to
allow correlations of simulation runs.

The ‘llvm.readcyclecounter‘ intrinsic provides access to the cycle
counter register (or similar low latency, high accuracy clocks) on those
targets that support it. On X86, it should map to RDTSC. On Alpha, it
should map to RPCC. As the backing counters overflow quickly (on the
order of 9 seconds on alpha), this should only be used for small
timings.

When directly supported, reading the cycle counter should not modify any
memory. Implementations are allowed to either return a application
specific value or a system wide value. On backends without support, this
is lowered to a constant 0.

Note that runtime support may be conditional on the privilege-level code is
running at and the host platform.

The ‘llvm.clear_cache‘ intrinsic ensures visibility of modifications
in the specified range to the execution unit of the processor. On
targets with non-unified instruction and data cache, the implementation
flushes the instruction cache.

On platforms with coherent instruction and data caches (e.g. x86), this
intrinsic is a nop. On platforms with non-coherent instruction and data
cache (e.g. ARM, MIPS), the intrinsic is lowered either to appropriate
instructions or a system call, if cache flushing requires special
privileges.

The default behavior is to emit a call to __clear_cache from the run
time library.

This instrinsic does not empty the instruction pipeline. Modifications
of the current function are outside the scope of the intrinsic.

The ‘llvm.instrprof_increment‘ intrinsic can be emitted by a
frontend for use with instrumentation based profiling. These will be
lowered by the -instrprof pass to generate execution counts of a
program at runtime.

The first argument is a pointer to a global variable containing the
name of the entity being instrumented. This should generally be the
(mangled) function name for a set of counters.

The second argument is a hash value that can be used by the consumer
of the profile data to detect changes to the instrumented source, and
the third is the number of counters associated with name. It is an
error if hash or num-counters differ between two instances of
instrprof_increment that refer to the same name.

The last argument refers to which of the counters for name should
be incremented. It should be a value between 0 and num-counters.

This intrinsic represents an increment of a profiling counter. It will
cause the -instrprof pass to generate the appropriate data
structures and the code to increment the appropriate value, in a
format that can be written out by a compiler runtime and consumed via
the llvm-profdata tool.

LLVM provides intrinsics for a few important standard C library
functions. These intrinsics allow source-language front-ends to pass
information about the alignment of the pointer arguments to the code
generator, providing opportunity for more efficient code generation.

The first argument is a pointer to the destination, the second is a
pointer to the source. The third argument is an integer argument
specifying the number of bytes to copy, the fourth argument is the
alignment of the source and destination locations, and the fifth is a
boolean indicating a volatile access.

If the call to this intrinsic has an alignment value that is not 0 or 1,
then the caller guarantees that both the source and destination pointers
are aligned to that boundary.

If the isvolatile parameter is true, the llvm.memcpy call is
a volatile operation. The detailed access behavior is not
very cleanly specified and it is unwise to depend on it.

The ‘llvm.memcpy.*‘ intrinsics copy a block of memory from the
source location to the destination location, which are not allowed to
overlap. It copies “len” bytes of memory over. If the argument is known
to be aligned to some boundary, this can be specified as the fourth
argument, otherwise it should be set to 0 or 1 (both meaning no alignment).

The ‘llvm.memmove.*‘ intrinsics move a block of memory from the
source location to the destination location. It is similar to the
‘llvm.memcpy‘ intrinsic but allows the two memory locations to
overlap.

Note that, unlike the standard libc function, the llvm.memmove.*
intrinsics do not return a value, takes extra alignment/isvolatile
arguments and the pointers can be in specified address spaces.

The first argument is a pointer to the destination, the second is a
pointer to the source. The third argument is an integer argument
specifying the number of bytes to copy, the fourth argument is the
alignment of the source and destination locations, and the fifth is a
boolean indicating a volatile access.

If the call to this intrinsic has an alignment value that is not 0 or 1,
then the caller guarantees that the source and destination pointers are
aligned to that boundary.

If the isvolatile parameter is true, the llvm.memmove call
is a volatile operation. The detailed access behavior is
not very cleanly specified and it is unwise to depend on it.

The ‘llvm.memmove.*‘ intrinsics copy a block of memory from the
source location to the destination location, which may overlap. It
copies “len” bytes of memory over. If the argument is known to be
aligned to some boundary, this can be specified as the fourth argument,
otherwise it should be set to 0 or 1 (both meaning no alignment).

The ‘llvm.memset.*‘ intrinsics fill a block of memory with a
particular byte value.

Note that, unlike the standard libc function, the llvm.memset
intrinsic does not return a value and takes extra alignment/volatile
arguments. Also, the destination can be in an arbitrary address space.

The first argument is a pointer to the destination to fill, the second
is the byte value with which to fill it, the third argument is an
integer argument specifying the number of bytes to fill, and the fourth
argument is the known alignment of the destination location.

If the call to this intrinsic has an alignment value that is not 0 or 1,
then the caller guarantees that the destination pointer is aligned to
that boundary.

If the isvolatile parameter is true, the llvm.memset call is
a volatile operation. The detailed access behavior is not
very cleanly specified and it is unwise to depend on it.

The ‘llvm.memset.*‘ intrinsics fill “len” bytes of memory starting
at the destination location. If the argument is known to be aligned to
some boundary, this can be specified as the fourth argument, otherwise
it should be set to 0 or 1 (both meaning no alignment).

The ‘llvm.sqrt‘ intrinsics return the sqrt of the specified operand,
returning the same value as the libm ‘sqrt‘ functions would. Unlike
sqrt in libm, however, llvm.sqrt has undefined behavior for
negative numbers other than -0.0 (which allows for better optimization,
because there is no need to worry about errno being set).
llvm.sqrt(-0.0) is defined to return -0.0 like IEEE sqrt.

The ‘llvm.powi.*‘ intrinsics return the first operand raised to the
specified (positive or negative) power. The order of evaluation of
multiplications is not defined. When a vector of floating point type is
used, the second argument remains a scalar integer value.

Follows the IEEE-754 semantics for minNum, which also match for libm’s
fmin.

If either operand is a NaN, returns the other non-NaN operand. Returns
NaN only if both operands are NaN. If the operands compare equal,
returns a value that compares equal to both operands. This means that
fmin(+/-0.0, +/-0.0) could return either -0.0 or 0.0.

Follows the IEEE-754 semantics for maxNum, which also match for libm’s
fmax.

If either operand is a NaN, returns the other non-NaN operand. Returns
NaN only if both operands are NaN. If the operands compare equal,
returns a value that compares equal to both operands. This means that
fmax(+/-0.0, +/-0.0) could return either -0.0 or 0.0.

The ‘llvm.bswap‘ family of intrinsics is used to byte swap integer
values with an even number of bytes (positive multiple of 16 bits).
These are useful for performing operations on data that is not in the
target’s native byte order.

The llvm.bswap.i16 intrinsic returns an i16 value that has the high
and low byte of the input i16 swapped. Similarly, the llvm.bswap.i32
intrinsic returns an i32 value that has the four bytes of the input i32
swapped, so that if the input bytes are numbered 0, 1, 2, 3 then the
returned i32 will have its bytes in 3, 2, 1, 0 order. The
llvm.bswap.i48, llvm.bswap.i64 and other intrinsics extend this
concept to additional even-byte lengths (6 bytes, 8 bytes and more,
respectively).

The first argument is the value to be counted. This argument may be of
any integer type, or a vector with integer element type. The return
type must match the first argument type.

The second argument must be a constant and is a flag to indicate whether
the intrinsic should ensure that a zero as the first argument produces a
defined result. Historically some architectures did not provide a
defined result for zero values as efficiently, and many algorithms are
now predicated on avoiding zero-value inputs.

The ‘llvm.ctlz‘ intrinsic counts the leading (most significant)
zeros in a variable, or within each element of the vector. If
src==0 then the result is the size in bits of the type of src
if is_zero_undef==0 and undef otherwise. For example,
llvm.ctlz(i322)=30.

The first argument is the value to be counted. This argument may be of
any integer type, or a vector with integer element type. The return
type must match the first argument type.

The second argument must be a constant and is a flag to indicate whether
the intrinsic should ensure that a zero as the first argument produces a
defined result. Historically some architectures did not provide a
defined result for zero values as efficiently, and many algorithms are
now predicated on avoiding zero-value inputs.

The ‘llvm.cttz‘ intrinsic counts the trailing (least significant)
zeros in a variable, or within each element of a vector. If src==0
then the result is the size in bits of the type of src if
is_zero_undef==0 and undef otherwise. For example,
llvm.cttz(2)=1.

The arguments (%a and %b) and the first element of the result structure
may be of integer types of any bit width, but they must have the same
bit width. The second element of the result structure must be of type
i1. %a and %b are the two values that will undergo signed
addition.

The ‘llvm.sadd.with.overflow‘ family of intrinsic functions perform
a signed addition of the two variables. They return a structure — the
first element of which is the signed summation, and the second element
of which is a bit specifying if the signed summation resulted in an
overflow.

The arguments (%a and %b) and the first element of the result structure
may be of integer types of any bit width, but they must have the same
bit width. The second element of the result structure must be of type
i1. %a and %b are the two values that will undergo unsigned
addition.

The ‘llvm.uadd.with.overflow‘ family of intrinsic functions perform
an unsigned addition of the two arguments. They return a structure — the
first element of which is the sum, and the second element of which is a
bit specifying if the unsigned summation resulted in a carry.

The arguments (%a and %b) and the first element of the result structure
may be of integer types of any bit width, but they must have the same
bit width. The second element of the result structure must be of type
i1. %a and %b are the two values that will undergo signed
subtraction.

The ‘llvm.ssub.with.overflow‘ family of intrinsic functions perform
a signed subtraction of the two arguments. They return a structure — the
first element of which is the subtraction, and the second element of
which is a bit specifying if the signed subtraction resulted in an
overflow.

The arguments (%a and %b) and the first element of the result structure
may be of integer types of any bit width, but they must have the same
bit width. The second element of the result structure must be of type
i1. %a and %b are the two values that will undergo unsigned
subtraction.

The ‘llvm.usub.with.overflow‘ family of intrinsic functions perform
an unsigned subtraction of the two arguments. They return a structure —
the first element of which is the subtraction, and the second element of
which is a bit specifying if the unsigned subtraction resulted in an
overflow.

The arguments (%a and %b) and the first element of the result structure
may be of integer types of any bit width, but they must have the same
bit width. The second element of the result structure must be of type
i1. %a and %b are the two values that will undergo signed
multiplication.

The ‘llvm.smul.with.overflow‘ family of intrinsic functions perform
a signed multiplication of the two arguments. They return a structure —
the first element of which is the multiplication, and the second element
of which is a bit specifying if the signed multiplication resulted in an
overflow.

The arguments (%a and %b) and the first element of the result structure
may be of integer types of any bit width, but they must have the same
bit width. The second element of the result structure must be of type
i1. %a and %b are the two values that will undergo unsigned
multiplication.

The ‘llvm.umul.with.overflow‘ family of intrinsic functions perform
an unsigned multiplication of the two arguments. They return a structure —
the first element of which is the multiplication, and the second
element of which is a bit specifying if the unsigned multiplication
resulted in an overflow.

The ‘llvm.canonicalize.*‘ intrinsic returns the platform specific canonical
encoding of a floating point number. This canonicalization is useful for
implementing certain numeric primitives such as frexp. The canonical encoding is
defined by IEEE-754-2008 to be:

2.1.8 canonical encoding: The preferred encoding of a floating-point
representation in a format. Applied to declets, significands of finite
numbers, infinities, and NaNs, especially in decimal formats.

This operation can also be considered equivalent to the IEEE-754-2008
conversion of a floating-point value to the same format. NaNs are handled
according to section 6.2.

Many normal decimal floating point numbers have non-canonical alternative
encodings.

Some machines, like GPUs or ARMv7 NEON, do not support subnormal values.
These are treated as non-canonical encodings of zero and with be flushed to
a zero of the same sign by this operation.

Note that per IEEE-754-2008 6.2, systems that support signaling NaNs with
default exception handling must signal an invalid exception, and produce a
quiet NaN result.

This function should always be implementable as multiplication by 1.0, provided
that the compiler does not constant fold the operation. Likewise, division by
1.0 and llvm.minnum(x,x) are possible implementations. Addition with
-0.0 is also sufficient provided that the rounding mode is not -Infinity.

@llvm.canonicalize must preserve the equality relation. That is:

(@llvm.canonicalize(x)==x) is equivalent to (x==x)

(@llvm.canonicalize(x)==@llvm.canonicalize(y)) is equivalent to
to (x==y)

Additionally, the sign of zero must be conserved:
@llvm.canonicalize(-0.0)=-0.0 and @llvm.canonicalize(+0.0)=+0.0

The payload bits of a NaN must be conserved, with two exceptions.
First, environments which use only a single canonical representation of NaN
must perform said canonicalization. Second, SNaNs must be quieted per the
usual methods.

The canonicalization operation may be optimized away if:

The input is known to be canonical. For example, it was produced by a
floating-point operation that is required by the standard to be canonical.

The result is consumed only by (or fused with) other floating-point
operations. That is, the bits of the floating point value are not examined.

The ‘llvm.fmuladd.*‘ intrinsic functions represent multiply-add
expressions that can be fused if the code generator determines that (a) the
target instruction set has support for a fused operation, and (b) that the
fused operation is more efficient than the equivalent, separate pair of mul
and add instructions.

is equivalent to the expression a * b + c, except that rounding will
not be performed between the multiplication and addition steps if the
code generator fuses the operations. Fusion is not guaranteed, even if
the target platform supports it. If a fused multiply-add is required the
corresponding llvm.fma.* intrinsic function should be used
instead. This never sets errno, just as ‘llvm.fma.*‘.

For most target platforms, half precision floating point is a
storage-only format. This means that it is a dense encoding (in memory)
but does not support computation in the format.

This means that code must first load the half-precision floating point
value as an i16, then convert it to float with
llvm.convert.from.fp16. Computation can
then be performed on the float value (including extending to double
etc). To store the value back to memory, it is first converted to float
if needed, then converted to i16 with
llvm.convert.to.fp16, then storing as an
i16 value.

The ‘llvm.convert.to.fp16‘ intrinsic function performs a conversion from a
conventional floating point format to half precision floating point format. The
return value is an i16 which contains the converted number.

The ‘llvm.convert.from.fp16‘ intrinsic function performs a
conversion from half single precision floating point format to single
precision floating point format. The input half-float value is
represented by an i16 value.

These intrinsics make it possible to excise one parameter, marked with
the nest attribute, from a function. The result is a
callable function pointer lacking the nest parameter - the caller does
not need to provide a value for it. Instead, the value to use is stored
in advance in a “trampoline”, a block of memory usually allocated on the
stack, which also contains code to splice the nest value into the
argument list. This is used to implement the GCC nested function address
extension.

For example, if the function is i32f(i8*nest%c,i32%x,i32%y)
then the resulting function pointer has signature i32(i32,i32)*.
It can be created as follows:

%tramp=alloca[10xi8],align4; size and alignment only correct for X86%tramp1=getelementptr[10xi8],[10xi8]*%tramp,i320,i320calli8*@llvm.init.trampoline(i8*%tramp1,i8*bitcast(i32(i8*,i32,i32)*@ftoi8*),i8*%nval)%p=calli8*@llvm.adjust.trampoline(i8*%tramp1)%fp=bitcasti8*%ptoi32(i32,i32)*

The call %val=calli32%fp(i32%x,i32%y) is then equivalent to
%val=calli32%f(i8*%nval,i32%x,i32%y).

The llvm.init.trampoline intrinsic takes three arguments, all
pointers. The tramp argument must point to a sufficiently large and
sufficiently aligned block of memory; this memory is written to by the
intrinsic. Note that the size and the alignment are target-specific -
LLVM currently provides no portable way of determining them, so a
front-end that generates this intrinsic needs to have some
target-specific knowledge. The func argument must hold a function
bitcast to an i8*.

The block of memory pointed to by tramp is filled with target
dependent code, turning it into a function. Then tramp needs to be
passed to llvm.adjust.trampoline to get a pointer which can
be bitcast (to a new function) and called. The new
function’s signature is the same as that of func with any arguments
marked with the nest attribute removed. At most one such nest
argument is allowed, and it must be of pointer type. Calling the new
function is equivalent to calling func with the same argument list,
but with nval used for the missing nest argument. If, after
calling llvm.init.trampoline, the memory pointed to by tramp is
modified, then the effect of any later call to the returned function
pointer is undefined.

On some architectures the address of the code to be executed needs to be
different than the address where the trampoline is actually stored. This
intrinsic returns the executable address corresponding to tramp
after performing the required machine specific adjustments. The pointer
returned can then be bitcast and executed.

LLVM provides intrinsics for predicated vector load and store operations. The predicate is specified by a mask operand, which holds one bit per vector element, switching the associated vector lane on or off. The memory addresses corresponding to the “off” lanes are not accessed. When all bits of the mask are on, the intrinsic is identical to a regular vector load or store. When all bits are off, no memory is accessed.

Reads a vector from memory according to the provided mask. The mask holds a bit for each vector lane, and is used to prevent memory accesses to the masked-off lanes. The masked-off lanes in the result vector are taken from the corresponding lanes of the ‘passthru‘ operand.

The first operand is the base pointer for the load. The second operand is the alignment of the source location. It must be a constant integer value. The third operand, mask, is a vector of boolean values with the same number of elements as the return type. The fourth is a pass-through value that is used to fill the masked-off lanes of the result. The return type, underlying type of the base pointer and the type of the ‘passthru‘ operand are the same vector types.

The ‘llvm.masked.load‘ intrinsic is designed for conditional reading of selected vector elements in a single IR operation. It is useful for targets that support vector masked loads and allows vectorizing predicated basic blocks on these targets. Other targets may support this intrinsic differently, for example by lowering it into a sequence of branches that guard scalar load operations.
The result of this operation is equivalent to a regular vector load instruction followed by a ‘select’ between the loaded and the passthru values, predicated on the same mask. However, using this intrinsic prevents exceptions on memory access to masked-off lanes.

The first operand is the vector value to be written to memory. The second operand is the base pointer for the store, it has the same underlying type as the value operand. The third operand is the alignment of the destination location. The fourth operand, mask, is a vector of boolean values. The types of the mask and the value operand must have the same number of vector elements.

The ‘llvm.masked.store‘ intrinsics is designed for conditional writing of selected vector elements in a single IR operation. It is useful for targets that support vector masked store and allows vectorizing predicated basic blocks on these targets. Other targets may support this intrinsic differently, for example by lowering it into a sequence of branches that guard scalar store operations.
The result of this operation is equivalent to a load-modify-store sequence. However, using this intrinsic prevents exceptions and data races on memory access to masked-off lanes.

LLVM provides intrinsics for vector gather and scatter operations. They are similar to Masked Vector Load and Store, except they are designed for arbitrary memory accesses, rather than sequential memory accesses. Gather and scatter also employ a mask operand, which holds one bit per vector element, switching the associated vector lane on or off. The memory addresses corresponding to the “off” lanes are not accessed. When all bits are off, no memory is accessed.

Reads scalar values from arbitrary memory locations and gathers them into one vector. The memory locations are provided in the vector of pointers ‘ptrs‘. The memory is accessed according to the provided mask. The mask holds a bit for each vector lane, and is used to prevent memory accesses to the masked-off lanes. The masked-off lanes in the result vector are taken from the corresponding lanes of the ‘passthru‘ operand.

The first operand is a vector of pointers which holds all memory addresses to read. The second operand is an alignment of the source addresses. It must be a constant integer value. The third operand, mask, is a vector of boolean values with the same number of elements as the return type. The fourth is a pass-through value that is used to fill the masked-off lanes of the result. The return type, underlying type of the vector of pointers and the type of the ‘passthru‘ operand are the same vector types.

The ‘llvm.masked.gather‘ intrinsic is designed for conditional reading of multiple scalar values from arbitrary memory locations in a single IR operation. It is useful for targets that support vector masked gathers and allows vectorizing basic blocks with data and control divergence. Other targets may support this intrinsic differently, for example by lowering it into a sequence of scalar load operations.
The semantics of this operation are equivalent to a sequence of conditional scalar loads with subsequent gathering all loaded values into a single vector. The mask restricts memory access to certain lanes and facilitates vectorization of predicated basic blocks.

This is an overloaded intrinsic. The data stored in memory is a vector of any integer or floating point data type. Each vector element is stored in an arbitrary memory addresses. Scatter with overlapping addresses is guaranteed to be ordered from least-significant to most-significant element.

Writes each element from the value vector to the corresponding memory address. The memory addresses are represented as a vector of pointers. Writing is done according to the provided mask. The mask holds a bit for each vector lane, and is used to prevent memory accesses to the masked-off lanes.

The first operand is a vector value to be written to memory. The second operand is a vector of pointers, pointing to where the value elements should be stored. It has the same underlying type as the value operand. The third operand is an alignment of the destination addresses. The fourth operand, mask, is a vector of boolean values. The types of the mask and the value operand must have the same number of vector elements.

The ‘llvm.masked.scatter‘ intrinsics is designed for writing selected vector elements to arbitrary memory addresses in a single IR operation. The operation may be conditional, when not all bits in the mask are switched on. It is useful for targets that support vector masked scatter and allows vectorizing basic blocks with data and control divergency. Other targets may support this intrinsic differently, for example by lowering it into a sequence of branches that guard scalar store operations.

This intrinsic indicates that before this point in the code, the value
of the memory pointed to by ptr is dead. This means that it is known
to never be used and has an undefined value. A load from the pointer
that precedes this intrinsic can be replaced with 'undef'.

This intrinsic indicates that after this point in the code, the value of
the memory pointed to by ptr is dead. This means that it is known to
never be used and has an undefined value. Any stores into the memory
object following this intrinsic may be removed as dead.

The first argument is the matching llvm.invariant.start intrinsic.
The second argument is a constant integer representing the size of the
object, or -1 if it is variable sized and the third argument is a
pointer to the object.

The first argument is a pointer to a value, the second is a pointer to a
global string, the third is a pointer to a global string which is the
source file name, and the last argument is the line number.

This intrinsic allows annotation of local variables with arbitrary
strings. This can be useful for special purpose optimizations that want
to look for these annotations. These have no other defined use; they are
ignored by code generation and optimization.

This is an overloaded intrinsic. You can use ‘llvm.ptr.annotation‘ on a
pointer to an integer of any width. NOTE you must specify an address space for
the pointer. The identifier for the default address space is the integer
‘0‘.

The first argument is a pointer to an integer value of arbitrary bitwidth
(result of some expression), the second is a pointer to a global string, the
third is a pointer to a global string which is the source file name, and the
last argument is the line number. It returns the value of the first argument.

This intrinsic allows annotation of a pointer to an integer with arbitrary
strings. This can be useful for special purpose optimizations that want to look
for these annotations. These have no other defined use; they are ignored by code
generation and optimization.

The first argument is an integer value (result of some expression), the
second is a pointer to a global string, the third is a pointer to a
global string which is the source file name, and the last argument is
the line number. It returns the value of the first argument.

This intrinsic allows annotations to be put on arbitrary expressions
with arbitrary strings. This can be useful for special purpose
optimizations that want to look for these annotations. These have no
other defined use; they are ignored by code generation and optimization.

The llvm.stackprotector intrinsic requires two pointer arguments.
The first argument is the value loaded from the stack guard
@__stack_chk_guard. The second variable is an alloca that has
enough space to hold the value of the guard.

This intrinsic causes the prologue/epilogue inserter to force the position of
the AllocaInst stack slot to be before local variables on the stack. This is
to ensure that if a local variable on the stack is overwritten, it will destroy
the value of the guard. When the function exits, the guard on the stack is
checked against the original guard by llvm.stackprotectorcheck. If they are
different, then llvm.stackprotectorcheck causes the program to abort by
calling the __stack_chk_fail() function.

This intrinsic is provided to perform the stack protector check by comparing
guard with the stack slot created by llvm.stackprotector and if the
values do not match call the __stack_chk_fail() function.

The reason to provide this as an IR level intrinsic instead of implementing it
via other IR operations is that in order to perform this operation at the IR
level without an intrinsic, one would need to create additional basic blocks to
handle the success/failure cases. This makes it difficult to stop the stack
protector check from disrupting sibling tail calls in Codegen. With this
intrinsic, we are able to generate the stack protector basic blocks late in
codegen after the tail call decision has occurred.

The llvm.objectsize intrinsic is designed to provide information to
the optimizers to determine at compile time whether a) an operation
(like memcpy) will overflow a buffer that corresponds to an object, or
b) that a runtime check for overflow isn’t necessary. An object in this
context means an allocation of a specific class, structure, array, or
other object.

The llvm.objectsize intrinsic takes two arguments. The first
argument is a pointer to or into the object. The second argument is
a boolean and determines whether llvm.objectsize returns 0 (if true)
or -1 (if false) when the object size is unknown. The second argument
only accepts constants.

The llvm.objectsize intrinsic is lowered to a constant representing
the size of the object concerned. If the size cannot be determined at
compile time, llvm.objectsize returns i32/i64-1or0 (depending
on the min argument).

The intrinsic allows the optimizer to assume that the provided condition is
always true whenever the control flow reaches the intrinsic call. No code is
generated for this intrinsic, and instructions that contribute only to the
provided condition are not used for code generation. If the condition is
violated during execution, the behavior is undefined.

Note that the optimizer might limit the transformations performed on values
used by the llvm.assume intrinsic in order to preserve the instructions
only used to form the intrinsic’s input argument. This might prove undesirable
if the extra information provided by the llvm.assume intrinsic does not cause
sufficient overall improvement in code quality. For this reason,
llvm.assume should not be used to document basic mathematical invariants
that the optimizer can otherwise deduce or facts that are of little use to the
optimizer.